{"id":"MAL-2026-18459","summary":"Malicious code in wallet-adapter-base (npm)","details":"wallet-adapter-base takes the unscoped name of @solana/wallet-adapter-base and has no functional code. Its preinstall script runs `node preinstall.js` on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook `https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U` as \"PC Notifier\". It was published by the npm account cutekitten05, which published axelarjs-sdk, cutekitten-test, bigbob22-test and sol-wallet-adapter with the same script on 2026-11-01.","modified":"2026-11-02T06:30:05.234104221Z","published":"2026-11-01T21:33:18Z","database_specific":{"iocs":{"files":[{"digests":{"sha256":"50d055feee2beeea222a96d191734adef75612a035c2284d1c307290af7872e9"},"note":"preinstall runs `node preinstall.js`, which POSTs hostname and username to a Discord webhook (wallet-adapter-base@1.0.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"note":"Executed by the preinstall script of wallet-adapter-base@1.0.0.","paths":["preinstall.js"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"d2709b8afcf5e5e2859d0b56c8f119b73c98fc56c32fb072baea5b51b1cc3554"}}],"urls":["https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U"]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/wallet-adapter-base"}],"affected":[{"package":{"name":"wallet-adapter-base","ecosystem":"npm","purl":"pkg:npm/wallet-adapter-base"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/wallet-adapter-base/MAL-2026-18459.json"}}],"schema_version":"1.9.2","credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}