{"id":"MAL-2026-18457","summary":"Malicious code in bigbob22-test (npm)","details":"bigbob22-test@1.0.0 has no functional code and an empty README. Its preinstall script runs `node preinstall.js` on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook `https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U` as \"PC Notifier\". It was published by the npm account cutekitten05, which used the same script in wallet-adapter-base, axelarjs-sdk, cutekitten-test and sol-wallet-adapter on 2026-11-01.","modified":"2026-11-02T06:30:05.224764278Z","published":"2026-11-01T21:27:39Z","database_specific":{"iocs":{"files":[{"note":"preinstall runs `node preinstall.js`, which POSTs hostname and username to a Discord webhook (bigbob22-test@1.0.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"d45c8c679c1e94212a39e95a5a1a6f217b3b294c9c95c3d61a84ef93027541ac"}},{"note":"Executed by the preinstall script of bigbob22-test@1.0.0.","paths":["preinstall.js"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"d2709b8afcf5e5e2859d0b56c8f119b73c98fc56c32fb072baea5b51b1cc3554"}}],"urls":["https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U"]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigbob22-test"}],"affected":[{"package":{"name":"bigbob22-test","ecosystem":"npm","purl":"pkg:npm/bigbob22-test"},"versions":["1.0.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bigbob22-test/MAL-2026-18457.json"}}],"schema_version":"1.9.2","credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}