{"id":"MAL-2026-18452","summary":"Malicious code in sol-wallet-adapter (npm)","details":"sol-wallet-adapter takes the unscoped name of @project-serum/sol-wallet-adapter and has no functional code. Its preinstall script runs `node preinstall.js` on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook `https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U` as \"PC Notifier\". Versions 1.0.0 and 1.0.1 were published on 2026-11-01 by the npm account cutekitten05; after they were removed, the account bigdevin55 re-created the name and published 1.0.7 with the same script on 2026-11-02, alongside contracts-upgradeable.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (07cf0cd27f95e20e7fe52b859d73556e78f15ca06afdcab19eb43a2616895dab)\nThe OpenSSF Package Analysis project identified 'sol-wallet-adapter' @ 1.0.7 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2026-11-02T06:30:05.231905184Z","published":"2026-11-01T01:46:22Z","database_specific":{"iocs":{"files":[{"note":"preinstall runs `node preinstall.js`, which POSTs hostname and username to a Discord webhook (sol-wallet-adapter@1.0.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"dfeda90b9284e4ba7c1dc613aec4ed9552eb47893292bdce405b266032c904c2"}},{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"7993cb7fb7b4ec406bd47343b2a1ee715d08a0f32960a6093fb41dc518d4f436"},"note":"Executed by the preinstall script of sol-wallet-adapter@1.0.0.","paths":["preinstall.js"]},{"note":"preinstall runs `node preinstall.js`, which POSTs hostname and username to a Discord webhook (sol-wallet-adapter@1.0.1).","paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"062e68a9970cf8d878f1f02bd53b8bdb152c54db57b381ee81b24200e49a09e9"}},{"note":"Executed by the preinstall script of sol-wallet-adapter@1.0.1.","paths":["preinstall.js"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"7993cb7fb7b4ec406bd47343b2a1ee715d08a0f32960a6093fb41dc518d4f436"}},{"paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"5ead50b074ac5e37fc015cce6fb5436898eb9dbd41d08043156d28a8f04c8fb6"},"note":"preinstall runs `node preinstall.js`, which POSTs hostname and username to a Discord webhook (sol-wallet-adapter@1.0.7)."},{"paths":["preinstall.js"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"d2709b8afcf5e5e2859d0b56c8f119b73c98fc56c32fb072baea5b51b1cc3554"},"note":"Executed by the preinstall script of sol-wallet-adapter@1.0.7."}],"urls":["https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U"]},"malicious-packages-origins":[{"sha256":"07cf0cd27f95e20e7fe52b859d73556e78f15ca06afdcab19eb43a2616895dab","source":"ossf-package-analysis","versions":["1.0.7"],"import_time":"2026-11-02T06:26:01.467375362Z","modified_time":"2026-11-02T03:21:51Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sol-wallet-adapter"}],"affected":[{"package":{"name":"sol-wallet-adapter","ecosystem":"npm","purl":"pkg:npm/sol-wallet-adapter"},"versions":["1.0.0","1.0.1","1.0.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sol-wallet-adapter/MAL-2026-18452.json"}}],"schema_version":"1.9.2","credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}