{"id":"MAL-2026-18451","kind":"package","aliases":["MAL-2026-18451"],"related":[],"title":"Malicious code in contracts-upgradeable (npm)","description":"contracts-upgradeable takes the unscoped name of @openzeppelin/contracts-upgradeable and has no functional code. Its preinstall script runs `node preinstall.js` on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook `https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U` as \"PC Notifier\". It was published on 2026-11-02 by the npm account bigdevin55, which published sol-wallet-adapter 1.0.7 with the same script the same day; the account cutekitten05 used the same webhook in packages published on 2026-11-01.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"contracts-upgradeable","fixed":[],"affected":"= 1.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T02:31:07+00:00","first_seen_at":"2026-11-02T06:51:32+00:00","triaged_at":"2026-11-02T06:53:12+00:00","updated_at":"2026-11-02T06:53:35+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-01':104C '-02':71C '-11':70C,103C '-18451':10A,13A '-2026':9A,12A '/api/webhooks/1566232728179843243/pm5rdircrrepqrba7ibaiqk1xoqliftmbaca5s8jd8nvxn5w-rs832dowhqs-g-j3n6u':61C '1.0.7':83C '2026':69C,102C 'account':75C,92C 'adapt':82C 'bigdevin55':76C 'canary.discord.com':60C 'canary.discord.com/api/webhooks/1566232728179843243/pm5rdircrrepqrba7ibaiqk1xoqliftmbaca5s8jd8nvxn5w-rs832dowhqs-g-j3n6u':59C 'code':2A,32C 'contract':5A,20C 'contracts':15A 'contracts-upgrad':4A,19C 'contracts-upgradeable':14A 'cutekitten05':93C 'day':90C 'discord':57C 'function':31C 'hostnam':47C 'instal':41C 'local':53C 'machin':45C 'mal':8A,11A 'malici':1A,17B 'name':25C 'node':37C 'notifi':64C 'npm':7A,40C,74C 'openzeppelin/contracts-upgradeable':27C 'os':49C 'packag':18B,99C 'pc':63C 'post':43C 'preinstal':34C 'preinstall.js':38C 'publish':67C,78C,100C 'run':36C 'script':35C,87C 'sol':80C 'sol-wallet-adapt':79C 'take':22C 'time':54C 'unscop':24C 'upgrad':6A,21C 'upgradeable':16A 'use':94C 'usernam':50C 'wallet':81C 'webhook':58C,97C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["contractsupgradeable"],"ptokens":["contracts","upgradeable"],"labels":["critical","malicious","npm","package"],"first_public_at":"2026-11-02T02:31:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18451","url":"https://osv.dev/vulnerability/MAL-2026-18451","severity":"critical","published_at":"2026-11-02T02:31:07+00:00","modified_at":"2026-11-02T06:00:06+00:00","first_seen_at":"2026-11-02T06:51:32+00:00","fetched_at":"2026-11-02T06:51:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}