{"id":"MAL-2026-18456","summary":"Malicious code in axelarjs-sdk (npm)","details":"axelarjs-sdk@1.0.1 takes the unscoped name of @axelar-network/axelarjs-sdk and has no functional code. Its preinstall script runs `node preinstall.js` on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook `https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U` as \"PC Notifier\". It was published by the npm account cutekitten05, which published wallet-adapter-base, cutekitten-test, bigbob22-test and sol-wallet-adapter with the same script on 2026-11-01.","modified":"2026-11-02T06:30:05.221855440Z","published":"2026-11-01T02:23:13Z","database_specific":{"iocs":{"files":[{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"14662fd75fe091b2df941b6f4a920dd5143fb989af8cdd0068a8b07003848bd2"},"note":"preinstall runs `node preinstall.js`, which POSTs hostname and username to a Discord webhook (axelarjs-sdk@1.0.1).","paths":["package.json"]},{"digests":{"sha256":"11958f28bc8ce7bb1095db8d2b83b720c0042f2719f78bd3a44ed0d4f033f104"},"note":"Executed by the preinstall script of axelarjs-sdk@1.0.1.","paths":["preinstall.js"],"source":"PACKAGE_ARCHIVE"}],"urls":["https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U"]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/axelarjs-sdk"}],"affected":[{"package":{"name":"axelarjs-sdk","ecosystem":"npm","purl":"pkg:npm/axelarjs-sdk"},"versions":["1.0.1"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/axelarjs-sdk/MAL-2026-18456.json"}}],"schema_version":"1.9.2","credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}