{"id":"MAL-2026-18458","summary":"Malicious code in cutekitten-test (npm)","details":"cutekitten-test@1.0.1 describes itself as a security test package for a school project and has no functional code. Its preinstall script runs `node preinstall.js` on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook `https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U` as \"PC Notifier\". It was published by the npm account cutekitten05, which used the same script in wallet-adapter-base, axelarjs-sdk, bigbob22-test and sol-wallet-adapter on 2026-11-01.","modified":"2026-11-02T06:30:05.234707766Z","published":"2026-11-01T01:32:20Z","database_specific":{"iocs":{"urls":["https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U"],"files":[{"paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"09503707421841093b4923ef405aa9655b70e8dc55d2e6f45fa2bc976bbb73b7"},"note":"preinstall runs `node preinstall.js`, which POSTs hostname and username to a Discord webhook (cutekitten-test@1.0.1)."},{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"7993cb7fb7b4ec406bd47343b2a1ee715d08a0f32960a6093fb41dc518d4f436"},"note":"Executed by the preinstall script of cutekitten-test@1.0.1.","paths":["preinstall.js"]}]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cutekitten-test"}],"affected":[{"package":{"name":"cutekitten-test","ecosystem":"npm","purl":"pkg:npm/cutekitten-test"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cutekitten-test/MAL-2026-18458.json"}}],"schema_version":"1.9.2","credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}