{"id":"MAL-2026-18451","summary":"Malicious code in contracts-upgradeable (npm)","details":"contracts-upgradeable takes the unscoped name of @openzeppelin/contracts-upgradeable and has no functional code. Its preinstall script runs `node preinstall.js` on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook `https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U` as \"PC Notifier\". It was published on 2026-11-02 by the npm account bigdevin55, which published sol-wallet-adapter 1.0.7 with the same script the same day; the account cutekitten05 used the same webhook in packages published on 2026-11-01.","modified":"2026-11-02T06:00:06.417793571Z","published":"2026-11-02T02:31:07Z","database_specific":{"iocs":{"files":[{"paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"d619f985a0aa87e19f7b87dcdee7a29ebe94fb3cdf62960d9c8425edcf554a0a"},"note":"preinstall runs `node preinstall.js`, which POSTs hostname and username to a Discord webhook (contracts-upgradeable@1.0.0)."},{"note":"Executed by the preinstall script of contracts-upgradeable@1.0.0.","paths":["preinstall.js"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"d2709b8afcf5e5e2859d0b56c8f119b73c98fc56c32fb072baea5b51b1cc3554"}}],"urls":["https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U"]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/contracts-upgradeable"}],"affected":[{"package":{"name":"contracts-upgradeable","ecosystem":"npm","purl":"pkg:npm/contracts-upgradeable"},"versions":["1.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/contracts-upgradeable/MAL-2026-18451.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.9.2","credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}