From 421194f0bff64ce14b0c0c3746c37ca13dfd246d Mon Sep 17 00:00:00 2001
From: Prajwal U <prajwalu142@bitgo.com>
Date: Fri, 10 Jul 2026 22:01:21 +0530
Subject: [PATCH] =?UTF-8?q?fix(stellar):=20upgrade=20stellar-sdk=20v10=20?=
 =?UTF-8?q?=E2=86=92=20@stellar/stellar-sdk=20v16?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Problem

stellar-sdk v10 bundles toml@2.3.6 which parses [__proto__] tables by
writing directly to Object.prototype (prototype pollution). Chained with
the SSRF in the XLM federation lookup endpoint and a Jade RCE sink, an
unauthenticated attacker can achieve remote code execution inside
wallet-platform pods. INFOSEC-191.

## Goal

Remove the prototype pollution sink at the root by upgrading to
@stellar/stellar-sdk v16, which replaces toml@2.3.6 with smol-toml — a
strict TOML 1.0 parser that never mutates Object.prototype.

## Fix

- Replaced stellar-sdk ^10.0.1 with @stellar/stellar-sdk ^16.0.0 in
  sdk-coin-xlm, sdk-coin-algo, sdk-coin-hbar, and bitgo packages.
- Updated all import sites from stellar-sdk to @stellar/stellar-sdk.
- Migrated stellar.Server → stellar.Horizon.Server (v11+ API split).
- Migrated stellar.FederationServer → stellar.Federation.Server; return
  type updated to stellar.Federation.Api.Record.
- Updated operation parameter types from the removed stellar.Operation
  instance type to stellar.OperationRecord (v16 discriminated union).
- Used @stellar/stellar-sdk/axios subpath for federation requests to
  preserve nock HTTP interception in tests (v16 defaults to native fetch).
- Removed conflicting bignumber.js v4 root resolution pins; added scoped
  pin for @stellar/stellar-sdk to prevent yarn hoisting v4 (lacks .clone).
- Simplified txToString to use tx.toXDR() available directly on
  TransactionBase in v16, removing the old overload cast workaround.

## Testing

Full unit test suites for sdk-coin-xlm (86 tests), sdk-coin-hbar (233),
and sdk-coin-algo all pass with zero failures, including the federation
lookup tests that exercise the axios subpath.

Ticket: INFOSEC-191
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 modules/bitgo/package.json                    |   2 +-
 .../bitgo/src/v2/internal/seedValidator.ts    |   2 +-
 modules/sdk-coin-algo/package.json            |   2 +-
 modules/sdk-coin-algo/src/algo.ts             |   2 +-
 modules/sdk-coin-algo/src/lib/utils.ts        |   2 +-
 modules/sdk-coin-algo/src/seedValidator.ts    |   2 +-
 modules/sdk-coin-hbar/package.json            |   2 +-
 modules/sdk-coin-hbar/src/hbar.ts             |   2 +-
 modules/sdk-coin-hbar/src/lib/utils.ts        |   2 +-
 modules/sdk-coin-hbar/src/seedValidator.ts    |   2 +-
 modules/sdk-coin-hbar/test/unit/utils.ts      |   2 +-
 modules/sdk-coin-xlm/package.json             |   2 +-
 modules/sdk-coin-xlm/src/getStellarKeys.ts    |   2 +-
 modules/sdk-coin-xlm/src/lib/keyPair.ts       |   2 +-
 modules/sdk-coin-xlm/src/lib/utils.ts         |   2 +-
 modules/sdk-coin-xlm/src/stellarToken.ts      |   2 +-
 modules/sdk-coin-xlm/src/txlm.ts              |   2 +-
 modules/sdk-coin-xlm/src/xlm.ts               |  57 +++---
 modules/sdk-coin-xlm/test/unit/keyPair.ts     |   2 +-
 modules/sdk-coin-xlm/test/unit/xlm.ts         |   2 +-
 package.json                                  |   3 +-
 yarn.lock                                     | 173 ++++++++----------
 22 files changed, 120 insertions(+), 151 deletions(-)

diff --git a/modules/bitgo/package.json b/modules/bitgo/package.json
index 13bd25bf3b..024153e685 100644
--- a/modules/bitgo/package.json
+++ b/modules/bitgo/package.json
@@ -136,7 +136,7 @@
     "bignumber.js": "^9.1.1",
     "lodash": "^4.18.0",
     "openpgp": "5.11.3",
-    "stellar-sdk": "^10.0.1",
+    "@stellar/stellar-sdk": "^16.0.0",
     "superagent": "^9.0.1"
   },
   "devDependencies": {
diff --git a/modules/bitgo/src/v2/internal/seedValidator.ts b/modules/bitgo/src/v2/internal/seedValidator.ts
index bf02ae4b79..9eb72704ab 100644
--- a/modules/bitgo/src/v2/internal/seedValidator.ts
+++ b/modules/bitgo/src/v2/internal/seedValidator.ts
@@ -1,4 +1,4 @@
-import * as stellar from 'stellar-sdk';
+import * as stellar from '@stellar/stellar-sdk';
 import * as _ from 'lodash';
 import { CoinFamily } from '@bitgo/statics';
 import { Hbar, Algo } from '@bitgo/account-lib';
diff --git a/modules/sdk-coin-algo/package.json b/modules/sdk-coin-algo/package.json
index 2d889da1c9..b99852a378 100644
--- a/modules/sdk-coin-algo/package.json
+++ b/modules/sdk-coin-algo/package.json
@@ -50,7 +50,7 @@
     "joi": "^17.4.0",
     "js-sha512": "0.8.0",
     "lodash": "^4.18.0",
-    "stellar-sdk": "^10.0.1",
+    "@stellar/stellar-sdk": "^16.0.0",
     "tweetnacl": "^1.0.3"
   },
   "devDependencies": {
diff --git a/modules/sdk-coin-algo/src/algo.ts b/modules/sdk-coin-algo/src/algo.ts
index f17cf0ec5e..c743c41580 100644
--- a/modules/sdk-coin-algo/src/algo.ts
+++ b/modules/sdk-coin-algo/src/algo.ts
@@ -32,7 +32,7 @@ import {
   AuditDecryptedKeyParams,
   TxIntentMismatchError,
 } from '@bitgo/sdk-core';
-import stellar from 'stellar-sdk';
+import * as stellar from '@stellar/stellar-sdk';
 import BigNumber from 'bignumber.js';
 import Utils from './lib/utils';
 import { TxData } from './lib/ifaces';
diff --git a/modules/sdk-coin-algo/src/lib/utils.ts b/modules/sdk-coin-algo/src/lib/utils.ts
index 9e248d8b84..aa471a1080 100644
--- a/modules/sdk-coin-algo/src/lib/utils.ts
+++ b/modules/sdk-coin-algo/src/lib/utils.ts
@@ -1,5 +1,5 @@
 import algosdk from 'algosdk';
-import stellar from 'stellar-sdk';
+import * as stellar from '@stellar/stellar-sdk';
 import * as hex from '@stablelib/hex';
 import * as nacl from 'tweetnacl';
 import base32 from 'hi-base32';
diff --git a/modules/sdk-coin-algo/src/seedValidator.ts b/modules/sdk-coin-algo/src/seedValidator.ts
index 64bcea32d0..cb0793341c 100644
--- a/modules/sdk-coin-algo/src/seedValidator.ts
+++ b/modules/sdk-coin-algo/src/seedValidator.ts
@@ -1,4 +1,4 @@
-import * as stellar from 'stellar-sdk';
+import * as stellar from '@stellar/stellar-sdk';
 import * as _ from 'lodash';
 import { CoinFamily } from '@bitgo/statics';
 import { algoUtils } from './lib';
diff --git a/modules/sdk-coin-hbar/package.json b/modules/sdk-coin-hbar/package.json
index c94b9c87c3..e98c6648a8 100644
--- a/modules/sdk-coin-hbar/package.json
+++ b/modules/sdk-coin-hbar/package.json
@@ -50,7 +50,7 @@
     "lodash": "^4.18.0",
     "long": "^5.2.3",
     "protobufjs": "^7.5.8",
-    "stellar-sdk": "^10.0.1",
+    "@stellar/stellar-sdk": "^16.0.0",
     "tweetnacl": "^1.0.3"
   },
   "devDependencies": {
diff --git a/modules/sdk-coin-hbar/src/hbar.ts b/modules/sdk-coin-hbar/src/hbar.ts
index 86db4bf1ad..60dc7b4006 100644
--- a/modules/sdk-coin-hbar/src/hbar.ts
+++ b/modules/sdk-coin-hbar/src/hbar.ts
@@ -26,7 +26,7 @@ import {
   AuditDecryptedKeyParams,
 } from '@bitgo/sdk-core';
 import { BigNumber } from 'bignumber.js';
-import * as stellar from 'stellar-sdk';
+import * as stellar from '@stellar/stellar-sdk';
 import { SeedValidator } from './seedValidator';
 import { KeyPair as HbarKeyPair, TransactionBuilderFactory, Transaction, Recipient as HederaRecipient } from './lib';
 import * as Utils from './lib/utils';
diff --git a/modules/sdk-coin-hbar/src/lib/utils.ts b/modules/sdk-coin-hbar/src/lib/utils.ts
index e41a633c7e..b38c5cccf5 100644
--- a/modules/sdk-coin-hbar/src/lib/utils.ts
+++ b/modules/sdk-coin-hbar/src/lib/utils.ts
@@ -2,7 +2,7 @@ import * as _ from 'lodash';
 import { AccountId, PrivateKey, PublicKey, TokenId, TransactionId } from '@hashgraph/sdk';
 import { proto } from '@hashgraph/proto';
 import BigNumber from 'bignumber.js';
-import * as stellar from 'stellar-sdk';
+import * as stellar from '@stellar/stellar-sdk';
 import { AddressDetails } from './iface';
 import url from 'url';
 import { toHex, toUint8Array, UtilsError } from '@bitgo/sdk-core';
diff --git a/modules/sdk-coin-hbar/src/seedValidator.ts b/modules/sdk-coin-hbar/src/seedValidator.ts
index 5e12732ad6..ea8a1bf41e 100644
--- a/modules/sdk-coin-hbar/src/seedValidator.ts
+++ b/modules/sdk-coin-hbar/src/seedValidator.ts
@@ -1,4 +1,4 @@
-import * as stellar from 'stellar-sdk';
+import * as stellar from '@stellar/stellar-sdk';
 import * as _ from 'lodash';
 import { CoinFamily } from '@bitgo/statics';
 import { createRawKey } from './lib/utils';
diff --git a/modules/sdk-coin-hbar/test/unit/utils.ts b/modules/sdk-coin-hbar/test/unit/utils.ts
index a5785cbc95..d5df11ca23 100644
--- a/modules/sdk-coin-hbar/test/unit/utils.ts
+++ b/modules/sdk-coin-hbar/test/unit/utils.ts
@@ -1,6 +1,6 @@
 import assert from 'assert';
 import should from 'should';
-import * as stellar from 'stellar-sdk';
+import * as stellar from '@stellar/stellar-sdk';
 import * as Utils from '../../src/lib/utils';
 import * as testData from '../resources/hbar';
 import { isValidEd25519PublicKey } from '@bitgo/sdk-core';
diff --git a/modules/sdk-coin-xlm/package.json b/modules/sdk-coin-xlm/package.json
index 426ab0fd35..22ae5540e9 100644
--- a/modules/sdk-coin-xlm/package.json
+++ b/modules/sdk-coin-xlm/package.json
@@ -44,7 +44,7 @@
     "@bitgo/statics": "^58.54.0",
     "bignumber.js": "^9.1.1",
     "lodash": "^4.18.0",
-    "stellar-sdk": "^10.0.1",
+    "@stellar/stellar-sdk": "^16.0.0",
     "superagent": "^9.0.1"
   },
   "devDependencies": {
diff --git a/modules/sdk-coin-xlm/src/getStellarKeys.ts b/modules/sdk-coin-xlm/src/getStellarKeys.ts
index bc0c751ed7..d6c0e6f43b 100644
--- a/modules/sdk-coin-xlm/src/getStellarKeys.ts
+++ b/modules/sdk-coin-xlm/src/getStellarKeys.ts
@@ -1,5 +1,5 @@
 import { BitGoBase, InitiateRecoveryOptions } from '@bitgo/sdk-core';
-import * as stellar from 'stellar-sdk';
+import * as stellar from '@stellar/stellar-sdk';
 import { Utils } from './lib';
 
 export async function getStellarKeys(bitgo: BitGoBase, params: InitiateRecoveryOptions): Promise<stellar.Keypair[]> {
diff --git a/modules/sdk-coin-xlm/src/lib/keyPair.ts b/modules/sdk-coin-xlm/src/lib/keyPair.ts
index 42b1567c6f..d1399b3a51 100644
--- a/modules/sdk-coin-xlm/src/lib/keyPair.ts
+++ b/modules/sdk-coin-xlm/src/lib/keyPair.ts
@@ -1,4 +1,4 @@
-import * as stellar from 'stellar-sdk';
+import * as stellar from '@stellar/stellar-sdk';
 import { DefaultKeys, Ed25519KeyPair, InvalidKey, KeyPairOptions } from '@bitgo/sdk-core';
 import { decodePrivateKey, decodePublicKey, encodePrivateKey, encodePublicKey } from './utils';
 
diff --git a/modules/sdk-coin-xlm/src/lib/utils.ts b/modules/sdk-coin-xlm/src/lib/utils.ts
index a203b05b16..79a65a2e90 100644
--- a/modules/sdk-coin-xlm/src/lib/utils.ts
+++ b/modules/sdk-coin-xlm/src/lib/utils.ts
@@ -1,5 +1,5 @@
 import { isValidEd25519PublicKey, isValidEd25519SecretKey } from '@bitgo/sdk-core';
-import * as stellar from 'stellar-sdk';
+import * as stellar from '@stellar/stellar-sdk';
 
 /**
  * Creates a Stellar keypair from a public key.
diff --git a/modules/sdk-coin-xlm/src/stellarToken.ts b/modules/sdk-coin-xlm/src/stellarToken.ts
index 9c2c06eda0..f7e44bbc4a 100644
--- a/modules/sdk-coin-xlm/src/stellarToken.ts
+++ b/modules/sdk-coin-xlm/src/stellarToken.ts
@@ -4,7 +4,7 @@
 import * as _ from 'lodash';
 import { Xlm } from './xlm';
 import { BitGoBase, BitGoJsError, CoinConstructor, NamedCoinConstructor } from '@bitgo/sdk-core';
-import * as stellar from 'stellar-sdk';
+import * as stellar from '@stellar/stellar-sdk';
 import { StellarTokenConfig, tokens } from '@bitgo/statics';
 
 export { StellarTokenConfig };
diff --git a/modules/sdk-coin-xlm/src/txlm.ts b/modules/sdk-coin-xlm/src/txlm.ts
index 9ada9302b7..80a55fe559 100644
--- a/modules/sdk-coin-xlm/src/txlm.ts
+++ b/modules/sdk-coin-xlm/src/txlm.ts
@@ -1,6 +1,6 @@
 import { BaseCoin, BitGoBase } from '@bitgo/sdk-core';
 import { Xlm } from './xlm';
-const stellar = require('stellar-sdk');
+const stellar = require('@stellar/stellar-sdk');
 
 export class Txlm extends Xlm {
   constructor(bitgo: BitGoBase) {
diff --git a/modules/sdk-coin-xlm/src/xlm.ts b/modules/sdk-coin-xlm/src/xlm.ts
index 02d56a71c7..49bd789763 100644
--- a/modules/sdk-coin-xlm/src/xlm.ts
+++ b/modules/sdk-coin-xlm/src/xlm.ts
@@ -2,7 +2,9 @@ import assert from 'assert';
 import { BigNumber } from 'bignumber.js';
 import * as _ from 'lodash';
 import * as querystring from 'querystring';
-import * as stellar from 'stellar-sdk';
+import * as stellar from '@stellar/stellar-sdk';
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const { Federation: FederationAxios } = require('@stellar/stellar-sdk/axios') as typeof stellar;
 import * as request from 'superagent';
 import * as url from 'url';
 import { KeyPair as StellarKeyPair } from './lib/keyPair';
@@ -364,7 +366,7 @@ export class Xlm extends BaseCoin {
    * @returns minimum balance in stroops
    */
   async getMinimumReserve(): Promise<number> {
-    const server = new stellar.Server(this.getHorizonUrl());
+    const server = new stellar.Horizon.Server(this.getHorizonUrl());
 
     const horizonLedgerInfo = await server.ledgers().order('desc').limit(1).call();
 
@@ -383,7 +385,7 @@ export class Xlm extends BaseCoin {
    * @returns transaction fee in stroops
    */
   async getBaseTransactionFee(): Promise<number> {
-    const server = new stellar.Server(this.getHorizonUrl());
+    const server = new stellar.Horizon.Server(this.getHorizonUrl());
 
     const horizonLedgerInfo = await server.ledgers().order('desc').limit(1).call();
 
@@ -531,11 +533,11 @@ export class Xlm extends BaseCoin {
    *
    * @returns instance of BitGo Federation Server
    */
-  getBitGoFederationServer(): stellar.FederationServer {
+  getBitGoFederationServer(): stellar.Federation.Server {
     // Identify the URI scheme in case we need to allow connecting to HTTP server.
     const isNonSecureEnv = !_.startsWith(common.Environments[this.bitgo.env].uri, 'https');
     const federationServerOptions = { allowHttp: isNonSecureEnv };
-    return new stellar.FederationServer(this.getFederationServerUrl(), 'bitgo.com', federationServerOptions);
+    return new FederationAxios.Server(this.getFederationServerUrl(), 'bitgo.com', federationServerOptions);
   }
 
   /**
@@ -551,7 +553,7 @@ export class Xlm extends BaseCoin {
   }: {
     address?: string;
     accountId?: string;
-  }): Promise<stellar.FederationServer.Record> {
+  }): Promise<stellar.Federation.Api.Record> {
     try {
       const federationServer = this.getBitGoFederationServer();
       if (address) {
@@ -576,7 +578,7 @@ export class Xlm extends BaseCoin {
    *
    * @param {String} address - stellar address to look for
    */
-  async federationLookupByName(address: string): Promise<stellar.FederationServer.Record> {
+  async federationLookupByName(address: string): Promise<stellar.Federation.Api.Record> {
     if (!address) {
       throw new Error('invalid Stellar address');
     }
@@ -590,7 +592,7 @@ export class Xlm extends BaseCoin {
    *
    * @param {String} accountId - stellar account id
    */
-  async federationLookupByAccountId(accountId: string): Promise<stellar.FederationServer.Record> {
+  async federationLookupByAccountId(accountId: string): Promise<stellar.Federation.Api.Record> {
     if (!accountId) {
       throw new Error('invalid Stellar account');
     }
@@ -917,7 +919,7 @@ export class Xlm extends BaseCoin {
     const outputs: TransactionOutput[] = [];
     const operations: TransactionOperation[] = []; // non-payment operations
 
-    _.forEach(tx.operations, (op: stellar.Operation) => {
+    _.forEach(tx.operations, (op) => {
       if (op.type === 'createAccount' || op.type === 'payment') {
         // TODO Remove memoId from address
         // Get memo to attach to address, if type is 'id'
@@ -997,11 +999,13 @@ export class Xlm extends BaseCoin {
   }
 
   getTrustlineOperationsOrThrow(
-    operations: stellar.Operation[],
+    operations: stellar.OperationRecord[],
     txParams: TransactionParams,
     operationTypePropName: 'trustlines' | 'recipients'
   ): stellar.Operation.ChangeTrust[] {
-    const trustlineOperations = operations.filter((op) => op?.type === 'changeTrust');
+    const trustlineOperations = operations.filter(
+      (op): op is stellar.Operation.ChangeTrust => op?.type === 'changeTrust'
+    );
     if (trustlineOperations.length !== _.get(txParams, operationTypePropName, []).length) {
       throw new Error('transaction prebuild does not match expected trustline operations');
     }
@@ -1009,16 +1013,16 @@ export class Xlm extends BaseCoin {
     return trustlineOperations;
   }
 
-  isChangeTrustOperation(operation: stellar.Operation): operation is stellar.Operation.ChangeTrust {
-    return operation.type && operation.type === 'changeTrust';
+  isChangeTrustOperation(operation: stellar.OperationRecord): operation is stellar.Operation.ChangeTrust {
+    return operation.type === 'changeTrust';
   }
 
-  getTrustlineOperationLineOrThrow(operation: stellar.Operation): stellar.Asset | stellar.LiquidityPoolAsset {
+  getTrustlineOperationLineOrThrow(operation: stellar.OperationRecord): stellar.Asset | stellar.LiquidityPoolAsset {
     if (this.isChangeTrustOperation(operation) && operation.line) return operation.line;
     throw new Error('Invalid operation - expected changeTrust operation with line property');
   }
 
-  getTrustlineOperationLimitOrThrow(operation: stellar.Operation): string {
+  getTrustlineOperationLimitOrThrow(operation: stellar.OperationRecord): string {
     if (this.isChangeTrustOperation(operation) && operation.limit) return operation.limit;
     throw new Error('Invalid operation - expected changeTrust operation with limit property');
   }
@@ -1034,9 +1038,9 @@ export class Xlm extends BaseCoin {
    * @param {stellar.Operation} operations - tx operations
    * @param {TransactionParams} txParams - params used to build the tx
    */
-  verifyTrustlineTxOperations(operations: stellar.Operation[], txParams: TransactionParams): void {
+  verifyTrustlineTxOperations(operations: stellar.OperationRecord[], txParams: TransactionParams): void {
     const trustlineOperations = this.getTrustlineOperationsOrThrow(operations, txParams, 'trustlines');
-    _.forEach(trustlineOperations, (op: stellar.Operation) => {
+    _.forEach(trustlineOperations, (op) => {
       if (op.type !== 'changeTrust') {
         throw new Error('Invalid asset type');
       }
@@ -1092,7 +1096,7 @@ export class Xlm extends BaseCoin {
     return issuer;
   }
 
-  verifyTxType(operations: stellar.Operation[]): void {
+  verifyTxType(operations: stellar.OperationRecord[]): void {
     operations.forEach((operation) => {
       if (!this.isChangeTrustOperation(operation))
         throw new Error(
@@ -1103,7 +1107,7 @@ export class Xlm extends BaseCoin {
     });
   }
 
-  verifyAssetType(txParams: TransactionParams, operations: stellar.Operation[]): void {
+  verifyAssetType(txParams: TransactionParams, operations: stellar.OperationRecord[]): void {
     operations.forEach((operation) => {
       const line = this.getTrustlineOperationLineOrThrow(operation);
       if (!this.isOperationLineOfAssetType(line)) {
@@ -1113,7 +1117,7 @@ export class Xlm extends BaseCoin {
     });
   }
 
-  verifyTokenIssuer(txParams: TransactionParams, operations: stellar.Operation[]): void {
+  verifyTokenIssuer(txParams: TransactionParams, operations: stellar.OperationRecord[]): void {
     const fullTokenData = this.getTokenDataOrThrow(txParams);
     const expectedIssuer = this.getIssuerFromTokenName(fullTokenData);
 
@@ -1125,7 +1129,7 @@ export class Xlm extends BaseCoin {
     });
   }
 
-  verifyTokenName(txParams: TransactionParams, operations: stellar.Operation[]): void {
+  verifyTokenName(txParams: TransactionParams, operations: stellar.OperationRecord[]): void {
     const fullTokenData = this.getTokenDataOrThrow(txParams);
     const expectedTokenCode = this.getTokenCodeFromTokenName(fullTokenData);
 
@@ -1140,7 +1144,7 @@ export class Xlm extends BaseCoin {
     });
   }
 
-  verifyTokenLimits(txParams: TransactionParams, operations: stellar.Operation[]): void {
+  verifyTokenLimits(txParams: TransactionParams, operations: stellar.OperationRecord[]): void {
     const recipient = this.getRecipientOrThrow(txParams);
 
     operations.forEach((operation) => {
@@ -1260,13 +1264,8 @@ export class Xlm extends BaseCoin {
     throw new NotSupported('method deriveKeyWithSeed not supported for eddsa curve');
   }
 
-  /**
-   * stellar-sdk has two overloads for toXDR, and typescript can't seem to figure out the
-   * correct one to use, so we have to be very explicit as to which one we want.
-   * @param tx transaction to convert
-   */
-  protected static txToString = (tx: stellar.Transaction): string =>
-    (tx.toEnvelope().toXDR as (_: string) => string)('base64');
+  // v16 exposes toXDR() directly on TransactionBase, returning base64
+  protected static txToString = (tx: stellar.Transaction): string => tx.toXDR();
 
   async parseTransaction(params: ParseTransactionOptions): Promise<ParsedTransaction> {
     return {};
diff --git a/modules/sdk-coin-xlm/test/unit/keyPair.ts b/modules/sdk-coin-xlm/test/unit/keyPair.ts
index 00219d3634..3eb95484ec 100644
--- a/modules/sdk-coin-xlm/test/unit/keyPair.ts
+++ b/modules/sdk-coin-xlm/test/unit/keyPair.ts
@@ -1,5 +1,5 @@
 import * as should from 'should';
-import * as stellar from 'stellar-sdk';
+import * as stellar from '@stellar/stellar-sdk';
 import { KeyPair } from '../../src';
 import { randomBytes } from 'crypto';
 import assert from 'assert';
diff --git a/modules/sdk-coin-xlm/test/unit/xlm.ts b/modules/sdk-coin-xlm/test/unit/xlm.ts
index 64e4eba532..346c3f46df 100644
--- a/modules/sdk-coin-xlm/test/unit/xlm.ts
+++ b/modules/sdk-coin-xlm/test/unit/xlm.ts
@@ -1,6 +1,6 @@
 import { randomBytes } from 'crypto';
 import * as should from 'should';
-import * as stellar from 'stellar-sdk';
+import * as stellar from '@stellar/stellar-sdk';
 
 import { BitGoAPI, encrypt } from '@bitgo/sdk-api';
 import { Environments, PrebuildAndSignTransactionOptions, Wallet } from '@bitgo/sdk-core';
diff --git a/package.json b/package.json
index b5aeb7ca50..740346467b 100644
--- a/package.json
+++ b/package.json
@@ -107,8 +107,7 @@
     "cookie": "^0.7.1",
     "axios": "1.16.1",
     "canvg": "4.0.3",
-    "**/stellar-sdk/**/bignumber.js": "4.1.0",
-    "**/stellar-base/**/bignumber.js": "4.1.0",
+    "**/@stellar/stellar-sdk/**/bignumber.js": "^11.1.1",
     "bignumber.js": "9.1.2",
     "form-data": "^4.0.4",
     "**/avalanche/**/ws": "8.18.3",
diff --git a/yarn.lock b/yarn.lock
index 4eabf566b6..58fe61b901 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3718,6 +3718,11 @@
   dependencies:
     "@noble/hashes" "1.8.0"
 
+"@noble/ed25519@^3.1.0":
+  version "3.1.0"
+  resolved "https://registry.npmjs.org/@noble/ed25519/-/ed25519-3.1.0.tgz#f72f53c9ef2a3feebd59caee0bb5b2d4f766aa08"
+  integrity sha512-pfcObRY3CtvwfaG9Mt5XqZdKmAQppl37tHUeuBhDUbiwJBCVY4/A4lbMvb1xKhMDx96AqAqZpMWuBX1HulhX4g==
+
 "@noble/hashes@1.2.0", "@noble/hashes@~1.2.0":
   version "1.2.0"
   resolved "https://registry.npmjs.org/@noble/hashes/-/hashes-1.2.0.tgz"
@@ -3748,6 +3753,11 @@
   resolved "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz"
   integrity sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==
 
+"@noble/hashes@^2.2.0":
+  version "2.2.0"
+  resolved "https://registry.npmjs.org/@noble/hashes/-/hashes-2.2.0.tgz#22da1d16a469954fce877055d559900a6c73b63b"
+  integrity sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg==
+
 "@noble/secp256k1@1.6.3":
   version "1.6.3"
   resolved "https://registry.npmjs.org/@noble/secp256k1/-/secp256k1-1.6.3.tgz"
@@ -5535,6 +5545,29 @@
     sha.js "^2.4.11"
     smart-buffer "^4.1.0"
 
+"@stellar/js-xdr@4.0.0":
+  version "4.0.0"
+  resolved "https://registry.npmjs.org/@stellar/js-xdr/-/js-xdr-4.0.0.tgz#5c4bd396a71ea3aef7a91dee885cf8dd2e10c5cf"
+  integrity sha512-+NmNa7Tk5BI5XFdy/6xGTqAN4J9a9KgCrCGhj2uEUTCBhLkch0M+QbKzNH8zEnejWe0p8w+0q5hUVX6L3OzoVA==
+
+"@stellar/stellar-sdk@^16.0.0":
+  version "16.0.1"
+  resolved "https://registry.npmjs.org/@stellar/stellar-sdk/-/stellar-sdk-16.0.1.tgz#041ade4e5cecfcc4c2ed3451fe7e3901ae3edf35"
+  integrity sha512-bxKohaiyKVqoudRhbOOHeHhHIaeYV5Zab4rCjxhP4Ty1h1ozTLBOv8lWFnZz9ilBzXG8Bb7usQI3rlEcfvUynA==
+  dependencies:
+    "@noble/ed25519" "^3.1.0"
+    "@noble/hashes" "^2.2.0"
+    "@stellar/js-xdr" "4.0.0"
+    axios "1.16.1"
+    base32.js "^0.1.0"
+    bignumber.js "^11.1.1"
+    buffer "^6.0.3"
+    commander "^14.0.3"
+    eventsource "^4.1.0"
+    feaxios "^0.0.23"
+    smol-toml "^1.6.1"
+    uint8array-extras "^1.5.0"
+
 "@substrate/connect-extension-protocol@^2.0.0":
   version "2.2.2"
   resolved "https://registry.npmjs.org/@substrate/connect-extension-protocol/-/connect-extension-protocol-2.2.2.tgz"
@@ -6031,11 +6064,6 @@
   resolved "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz"
   integrity sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==
 
-"@types/eventsource@^1.1.2":
-  version "1.1.15"
-  resolved "https://registry.npmjs.org/@types/eventsource/-/eventsource-1.1.15.tgz"
-  integrity sha512-XQmGcbnxUNa06HR3VBVkc9+A2Vpi9ZyLJcdS5dwaQQ/4ZMWFO+5c90FnMUpbtMZwB/FChoYHwuVg8TvkECacTA==
-
 "@types/expect@^1.20.4":
   version "1.20.4"
   resolved "https://registry.npmjs.org/@types/expect/-/expect-1.20.4.tgz"
@@ -6237,7 +6265,7 @@
   dependencies:
     "@types/node" "*"
 
-"@types/node@*", "@types/node@>= 8", "@types/node@>=10.0.0", "@types/node@>=13.7.0", "@types/node@^24.10.9":
+"@types/node@*", "@types/node@>=10.0.0", "@types/node@>=13.7.0", "@types/node@^24.10.9":
   version "24.10.9"
   resolved "https://registry.npmjs.org/@types/node/-/node-24.10.9.tgz"
   integrity sha512-ne4A0IpG3+2ETuREInjPNhUGis1SFjv1d5asp8MzEAGtOZeTeHVDOYqOgqfhvseqg/iXty2hjBf1zAOb7RNiNw==
@@ -6516,11 +6544,6 @@
   dependencies:
     source-map "^0.6.1"
 
-"@types/urijs@^1.19.6":
-  version "1.19.25"
-  resolved "https://registry.npmjs.org/@types/urijs/-/urijs-1.19.25.tgz"
-  integrity sha512-XOfUup9r3Y06nFAZh3WvO0rBU4OtlfPB/vgxpjg+NRdGU6CN6djdc6OEiH+PcqHCY6eFLo9Ista73uarf4gnBg==
-
 "@types/uuid@^8.3.4":
   version "8.3.4"
   resolved "https://registry.npmjs.org/@types/uuid/-/uuid-8.3.4.tgz"
@@ -7563,7 +7586,7 @@ aws4@^1.8.0:
   resolved "https://registry.npmjs.org/aws4/-/aws4-1.13.2.tgz"
   integrity sha512-lHe62zvbTB5eEABUVi/AwVh0ZKY9rMMDhmm+eeyuuUQbQ3+J+fONVQOZyj+DdrvD4BY33uYniyRJ4UJIaSKAfw==
 
-axios@0.25.0, axios@0.27.2, axios@1.16.1, axios@1.7.4, axios@^0.21.2, axios@^0.26.1, axios@^1.6.0, axios@^1.8.3:
+axios@0.27.2, axios@1.16.1, axios@1.7.4, axios@^0.21.2, axios@^0.26.1, axios@^1.6.0, axios@^1.8.3:
   version "1.16.1"
   resolved "https://registry.npmjs.org/axios/-/axios-1.16.1.tgz#517e29291d19d6e8cf919ff264f4fe157261ba12"
   integrity sha512-caYkukvroVPO8KrzuJEb50Hm07KwfBZPEC3VeFHTsqWHvKTsy54hjJz9BS/cdaypROE2rH6xvm9mHX4fgWkr3A==
@@ -7822,16 +7845,16 @@ bigint-mod-arith@^3.1.0:
   resolved "https://registry.npmjs.org/bigint-mod-arith/-/bigint-mod-arith-3.3.1.tgz"
   integrity sha512-pX/cYW3dCa87Jrzv6DAr8ivbbJRzEX5yGhdt8IutnX/PCIXfpx+mabWNK/M8qqh+zQ0J3thftUBHW0ByuUlG0w==
 
-bignumber.js@4.1.0, bignumber.js@^4.0.0:
-  version "4.1.0"
-  resolved "https://registry.npmjs.org/bignumber.js/-/bignumber.js-4.1.0.tgz#db6f14067c140bd46624815a7916c92d9b6c24b1"
-  integrity sha512-eJzYkFYy9L4JzXsbymsFn3p54D+llV27oTQ+ziJG7WFRheJcNZilgVXMG0LoZtlQSKBsJdWtLFqOD0u+U0jZKA==
-
 bignumber.js@9.0.0, bignumber.js@9.1.2, bignumber.js@^9.0.0, bignumber.js@^9.0.1, bignumber.js@^9.0.2, bignumber.js@^9.1.1, bignumber.js@^9.1.2:
   version "9.1.2"
   resolved "https://registry.npmjs.org/bignumber.js/-/bignumber.js-9.1.2.tgz#b7c4242259c008903b13707983b5f4bbd31eda0c"
   integrity sha512-2/mKyZH9K85bzOEfhXDBFZTGd1CTs+5IHpeFQo9luiBG7hghdC851Pj2WAhb6E3R6b9tZj/XKhbg4fum+Kepug==
 
+bignumber.js@^11.1.1:
+  version "11.1.5"
+  resolved "https://registry.npmjs.org/bignumber.js/-/bignumber.js-11.1.5.tgz#0f678769f989e6947138d16adaaaa475a9b0bc65"
+  integrity sha512-6WmzCNtUnfKpbozq+hOgWaZMMzORmYBwF1xZScyoIX3QRYWeKTtxxwDOW5tIz7C9BdjkIYHGTcelCLkXg0mndw==
+
 bin-links@^5.0.0:
   version "5.0.0"
   resolved "https://registry.npmjs.org/bin-links/-/bin-links-5.0.0.tgz"
@@ -8337,7 +8360,7 @@ buffer-xor@^1.0.2, buffer-xor@^1.0.3:
   resolved "https://registry.npmjs.org/buffer-xor/-/buffer-xor-1.0.3.tgz"
   integrity sha512-571s0T7nZWK6vB67HI5dyUF7wXiNcfaPPPTl6zYCNApANjIvYJTg7hlud/+cJpdAhS7dVzqMLmfhfHR3rAcOjQ==
 
-buffer@4.9.2, buffer@6.0.3, buffer@^5.0.2, buffer@^5.1.0, buffer@^5.2.1, buffer@^5.4.3, buffer@^5.5.0, buffer@^5.6.0, buffer@^5.7.1, buffer@^6.0.2, buffer@^6.0.3, buffer@~6.0.3:
+buffer@4.9.2, buffer@6.0.3, buffer@^5.0.2, buffer@^5.2.1, buffer@^5.4.3, buffer@^5.5.0, buffer@^5.6.0, buffer@^5.7.1, buffer@^6.0.2, buffer@^6.0.3, buffer@~6.0.3:
   version "6.0.3"
   resolved "https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz"
   integrity sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==
@@ -9010,6 +9033,11 @@ commander@^12.1.0:
   resolved "https://registry.npmjs.org/commander/-/commander-12.1.0.tgz"
   integrity sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA==
 
+commander@^14.0.3:
+  version "14.0.3"
+  resolved "https://registry.npmjs.org/commander/-/commander-14.0.3.tgz#425d79b48f9af82fcd9e4fc1ea8af6c5ec07bbc2"
+  integrity sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==
+
 commander@^2.15.0, commander@^2.20.0, commander@^2.20.3:
   version "2.20.3"
   resolved "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz"
@@ -9411,13 +9439,6 @@ crc-32@^1.2.0:
   resolved "https://registry.npmjs.org/crc-32/-/crc-32-1.2.2.tgz"
   integrity sha512-ROmzCKrTnOwybPcJApAA6WBWij23HVfGVNKqqrZpuyZOHqK2CwHSvpGuyt/UNNvaIjEd8X5IFGp4Mh+Ie1IHJQ==
 
-crc@^3.5.0:
-  version "3.8.0"
-  resolved "https://registry.npmjs.org/crc/-/crc-3.8.0.tgz"
-  integrity sha512-iX3mfgcTMIq3ZKLIsVFAbv7+Mc10kxabAGQb8HvjA1o3T1PIYprbakQ65d3I+2HGHt6nSKkM9PYjgoJO2KcFBQ==
-  dependencies:
-    buffer "^5.1.0"
-
 create-ecdh@^4.0.0, create-ecdh@^4.0.4:
   version "4.0.4"
   resolved "https://registry.npmjs.org/create-ecdh/-/create-ecdh-4.0.4.tgz"
@@ -10728,7 +10749,7 @@ es6-object-assign@^1.1.0:
   resolved "https://registry.npmjs.org/es6-object-assign/-/es6-object-assign-1.1.0.tgz"
   integrity sha512-MEl9uirslVwqQU369iHNWZXsI8yaZYGg/D65aOgZkeyFJwHYSxilf7rQzXKI7DdDuBPrBXbfk3sl9hJhmd5AUw==
 
-es6-promise@4.2.8, es6-promise@^4.0.3, es6-promise@^4.2.4:
+es6-promise@4.2.8, es6-promise@^4.0.3:
   version "4.2.8"
   resolved "https://registry.npmjs.org/es6-promise/-/es6-promise-4.2.8.tgz"
   integrity sha512-HJDGx5daxeIvxdBxvG2cb9g4tEvwIk3i8+nhX0yGrYmZUzbkdg8QbDevheDB8gd0//uPj4c1EQua8Q+MViT0/w==
@@ -11289,7 +11310,7 @@ events@^3.2.0, events@^3.3.0:
   resolved "https://registry.npmjs.org/events/-/events-3.3.0.tgz"
   integrity sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==
 
-eventsource@2.0.2, eventsource@^1.1.1:
+eventsource@2.0.2, eventsource@^4.1.0:
   version "2.0.2"
   resolved "https://registry.npmjs.org/eventsource/-/eventsource-2.0.2.tgz#76dfcc02930fb2ff339520b6d290da573a9e8508"
   integrity sha512-IzUmBGPR3+oUG9dUeXynyNmf91/3zUSJg1lCktzKw47OXuhco54U3r9B7O4XX+Rb1Itm9OZ2b0RkTs10bICOxA==
@@ -11632,6 +11653,13 @@ fdir@^6.4.3, fdir@^6.5.0:
   resolved "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz"
   integrity sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==
 
+feaxios@^0.0.23:
+  version "0.0.23"
+  resolved "https://registry.npmjs.org/feaxios/-/feaxios-0.0.23.tgz#76f37a2666232377ce75354e46dd85cbceeb1758"
+  integrity sha512-eghR0A21fvbkcQBgZuMfQhrXxJzC0GNUGC9fXhBge33D+mFDTwl0aJ35zoQQn575BhyjQitRc5N4f+L4cP708g==
+  dependencies:
+    is-retry-allowed "^3.0.0"
+
 fetch-blob@^3.1.2, fetch-blob@^3.1.4:
   version "3.2.0"
   resolved "https://registry.npmjs.org/fetch-blob/-/fetch-blob-3.2.0.tgz"
@@ -13487,6 +13515,11 @@ is-regex@~1.1.4:
     call-bind "^1.0.2"
     has-tostringtag "^1.0.0"
 
+is-retry-allowed@^3.0.0:
+  version "3.0.0"
+  resolved "https://registry.npmjs.org/is-retry-allowed/-/is-retry-allowed-3.0.0.tgz#ea79389fd350d156823c491bee9c69f485b1445c"
+  integrity sha512-9xH0xvoggby+u0uGF7cZXdrutWiBiaFG8ZT4YFPXL8NzkyAwX3AKGLeFQLvzDpM430+nDFBZ1LHkie/8ocL06A==
+
 is-set@^2.0.3:
   version "2.0.3"
   resolved "https://registry.npmjs.org/is-set/-/is-set-2.0.3.tgz"
@@ -13870,14 +13903,6 @@ js-sha512@0.8.0, js-sha512@^0.8.0:
   resolved "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz"
   integrity sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==
 
-js-xdr@^1.1.3:
-  version "1.3.0"
-  resolved "https://registry.npmjs.org/js-xdr/-/js-xdr-1.3.0.tgz"
-  integrity sha512-fjLTm2uBtFvWsE3l2J14VjTuuB8vJfeTtYuNS7LiLHDWIX2kt0l1pqq9334F8kODUkKPMuULjEcbGbkFFwhx5g==
-  dependencies:
-    lodash "^4.17.5"
-    long "^2.2.3"
-
 js-yaml@4.1.0, js-yaml@^4.1.0:
   version "4.1.0"
   resolved "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz"
@@ -14630,7 +14655,7 @@ lodash.upperfirst@^4.3.1:
   resolved "https://registry.npmjs.org/lodash.upperfirst/-/lodash.upperfirst-4.3.1.tgz"
   integrity sha512-sReKOYJIJf74dhJONhU4e0/shzi1trVbSWDOhKYE5XV2O+H7Sb2Dihwuc7xWxVl+DgFPyTqIN3zMfT9cq5iWDg==
 
-lodash@>=4.18.1, lodash@^4.17.11, lodash@^4.17.15, lodash@^4.17.19, lodash@^4.17.20, lodash@^4.17.21, lodash@^4.17.5, lodash@^4.18.0:
+lodash@>=4.18.1, lodash@^4.17.11, lodash@^4.17.15, lodash@^4.17.19, lodash@^4.17.20, lodash@^4.17.21, lodash@^4.18.0:
   version "4.18.1"
   resolved "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz#ff2b66c1f6326d59513de2407bf881439812771c"
   integrity sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==
@@ -14681,11 +14706,6 @@ lolex@^5.0.1:
   dependencies:
     "@sinonjs/commons" "^1.7.0"
 
-long@^2.2.3:
-  version "2.4.0"
-  resolved "https://registry.npmjs.org/long/-/long-2.4.0.tgz"
-  integrity sha512-ijUtjmO/n2A5PaosNG9ZGDsQ3vxJg7ZW8vsY8Kp0f2yIZWhSJvjmegV7t+9RPQKxKrvj8yKGehhS+po14hPLGQ==
-
 long@^4.0.0:
   version "4.0.0"
   resolved "https://registry.npmjs.org/long/-/long-4.0.0.tgz"
@@ -18661,7 +18681,7 @@ setprototypeof@1.2.0:
   resolved "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz"
   integrity sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==
 
-sha.js@>=2.4.12, sha.js@^2.3.6, sha.js@^2.4.0, sha.js@^2.4.11, sha.js@^2.4.8, sha.js@~2.4.4:
+sha.js@>=2.4.12, sha.js@^2.4.0, sha.js@^2.4.11, sha.js@^2.4.8, sha.js@~2.4.4:
   version "2.4.12"
   resolved "https://registry.npmjs.org/sha.js/-/sha.js-2.4.12.tgz#eb8b568bf383dfd1867a32c3f2b74eb52bdbf23f"
   integrity sha512-8LzC5+bvI45BjpfXU8V5fdU2mfeKiQe1D1gIMn7XUlF3OTUrpdJpPPH4EMAnF0DsHHdSZqCdSss5qCmJKuiO3w==
@@ -18959,6 +18979,11 @@ smart-buffer@^4.1.0, smart-buffer@^4.2.0:
   resolved "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz"
   integrity sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==
 
+smol-toml@^1.6.1:
+  version "1.7.0"
+  resolved "https://registry.npmjs.org/smol-toml/-/smol-toml-1.7.0.tgz#ed1b259ce7e05907df1abe758971bd0a0ef2c0dd"
+  integrity sha512-aqVvWoyO21L23mb+drl4RmMXbf6N7FdHjAhTRA9ZBL7apWBgfWC16KjrASI+1p9GAroljyMHj6fK67i0UiTNvQ==
+
 smoldot@2.0.26:
   version "2.0.26"
   resolved "https://registry.npmjs.org/smoldot/-/smoldot-2.0.26.tgz"
@@ -19030,13 +19055,6 @@ socks@2.7.3, socks@^2.6.2, socks@^2.8.3:
     ip-address "^9.0.5"
     smart-buffer "^4.2.0"
 
-sodium-native@^3.3.0:
-  version "3.4.1"
-  resolved "https://registry.npmjs.org/sodium-native/-/sodium-native-3.4.1.tgz"
-  integrity sha512-PaNN/roiFWzVVTL6OqjzYct38NSXewdl2wz8SRB51Br/MLIJPrbM3XexhVWkq7D3UWMysfrhKVf1v1phZq6MeQ==
-  dependencies:
-    node-gyp-build "^4.3.0"
-
 sonic-boom@^4.0.1:
   version "4.2.0"
   resolved "https://registry.npmjs.org/sonic-boom/-/sonic-boom-4.2.0.tgz"
@@ -19251,43 +19269,6 @@ statuses@2.0.1:
   resolved "https://registry.npmjs.org/statuses/-/statuses-1.5.0.tgz"
   integrity sha512-OpZ3zP+jT1PI7I8nemJX4AKmAX070ZkYPVWV/AaKTJl+tXCTGyVdC1a4SL8RUQYEwk/f34ZX8UTykN68FwrqAA==
 
-stellar-base@^8.2.2:
-  version "8.2.2"
-  resolved "https://registry.npmjs.org/stellar-base/-/stellar-base-8.2.2.tgz"
-  integrity sha512-YVCIuJXU1bPn+vU0ded+g0D99DcpYXH9CEXfpYEDc4Gf04h65YjOVhGojQBm1hqVHq3rKT7m1tgfNACkU84FTA==
-  dependencies:
-    base32.js "^0.1.0"
-    bignumber.js "^4.0.0"
-    crc "^3.5.0"
-    js-xdr "^1.1.3"
-    lodash "^4.17.21"
-    sha.js "^2.3.6"
-    tweetnacl "^1.0.3"
-  optionalDependencies:
-    sodium-native "^3.3.0"
-
-stellar-sdk@^10.0.1:
-  version "10.4.1"
-  resolved "https://registry.npmjs.org/stellar-sdk/-/stellar-sdk-10.4.1.tgz"
-  integrity sha512-Wdm2UoLuN9SNrSEHO0R/I+iZuRwUkfny1xg4akhGCpO8LQZw8QzuMTJvbEoMT3sHT4/eWYiteVLp7ND21xZf5A==
-  dependencies:
-    "@types/eventsource" "^1.1.2"
-    "@types/node" ">= 8"
-    "@types/randombytes" "^2.0.0"
-    "@types/urijs" "^1.19.6"
-    axios "0.25.0"
-    bignumber.js "^4.0.0"
-    detect-node "^2.0.4"
-    es6-promise "^4.2.4"
-    eventsource "^1.1.1"
-    lodash "^4.17.21"
-    randombytes "^2.1.0"
-    stellar-base "^8.2.2"
-    toml "^2.3.0"
-    tslib "^1.10.0"
-    urijs "^1.19.1"
-    utility-types "^3.7.0"
-
 stop-iteration-iterator@^1.1.0:
   version "1.1.0"
   resolved "https://registry.npmjs.org/stop-iteration-iterator/-/stop-iteration-iterator-1.1.0.tgz"
@@ -20030,11 +20011,6 @@ toidentifier@1.0.1:
   resolved "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz"
   integrity sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==
 
-toml@^2.3.0:
-  version "2.3.6"
-  resolved "https://registry.npmjs.org/toml/-/toml-2.3.6.tgz"
-  integrity sha512-gVweAectJU3ebq//Ferr2JUY4WKSDe5N+z0FvjDncLGyHmIDoxgY/2Ie4qfEIDm4IS7OA6Rmdm7pdEEdMcV/xQ==
-
 tonweb@^0.0.62:
   version "0.0.62"
   resolved "https://registry.npmjs.org/tonweb/-/tonweb-0.0.62.tgz"
@@ -20403,6 +20379,11 @@ uglify-js@^3.1.4:
   resolved "https://registry.npmjs.org/uglify-js/-/uglify-js-3.19.3.tgz"
   integrity sha512-v3Xu+yuwBXisp6QYTcH4UbH+xYJXqnq2m/LtQVWKWzYc1iehYnLixoQDN9FH6/j9/oybfd6W9Ghwkl8+UMKTKQ==
 
+uint8array-extras@^1.5.0:
+  version "1.5.0"
+  resolved "https://registry.npmjs.org/uint8array-extras/-/uint8array-extras-1.5.0.tgz#10d2a85213de3ada304fea1c454f635c73839e86"
+  integrity sha512-rvKSBiC5zqCCiDZ9kAOszZcDvdAHwwIKJG33Ykj43OKcWsnmcBRL09YTU4nOeHZ8Y2a7l1MgTd08SBe9A8Qj6A==
+
 uint8array-tools@0.0.7:
   version "0.0.7"
   resolved "https://registry.npmjs.org/uint8array-tools/-/uint8array-tools-0.0.7.tgz"
@@ -20572,11 +20553,6 @@ uri-js@^4.2.2:
   dependencies:
     punycode "^2.1.0"
 
-urijs@^1.19.1:
-  version "1.19.11"
-  resolved "https://registry.npmjs.org/urijs/-/urijs-1.19.11.tgz"
-  integrity sha512-HXgFDgDommxn5/bIv0cnQZsPhHDA90NPHD6+c/v21U5+Sx5hoP8+dP9IZXBU1gIfvdRfhG8cel9QNPeionfcCQ==
-
 url@0.10.3:
   version "0.10.3"
   resolved "https://registry.npmjs.org/url/-/url-0.10.3.tgz"
@@ -20658,11 +20634,6 @@ utila@~0.4:
   resolved "https://registry.npmjs.org/utila/-/utila-0.4.0.tgz"
   integrity sha512-Z0DbgELS9/L/75wZbro8xAnT50pBVFQZ+hUEueGDU5FN51YSCYM+jdxsfCiHjwNP/4LCDD0i/graKpeBnOXKRA==
 
-utility-types@^3.7.0:
-  version "3.11.0"
-  resolved "https://registry.npmjs.org/utility-types/-/utility-types-3.11.0.tgz"
-  integrity sha512-6Z7Ma2aVEWisaL6TvBCy7P8rm2LQoPv6dJ7ecIaIixHcwfbJ0x7mWdbcwlIM5IGQxPZSFYeqRCqlOOeKoJYMkw==
-
 utils-merge@1.0.1:
   version "1.0.1"
   resolved "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz"