{"id":"MAL-2026-18452","kind":"package","aliases":["MAL-2026-18452"],"related":[],"title":"Malicious code in sol-wallet-adapter (npm)","description":"sol-wallet-adapter takes the unscoped name of @project-serum/sol-wallet-adapter and has no functional code. Its preinstall script runs `node preinstall.js` on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook `https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U` as \"PC Notifier\". Versions 1.0.0 and 1.0.1 were published on 2026-11-01 by the npm account cutekitten05; after they were removed, the account bigdevin55 re-created the name and published 1.0.7 with the same script on 2026-11-02, alongside contracts-upgradeable.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ossf-package-analysis (07cf0cd27f95e20e7fe52b859d73556e78f15ca06afdcab19eb43a2616895dab)\nThe OpenSSF Package Analysis project identified 'sol-wallet-adapter' @ 1.0.7 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sol-wallet-adapter","fixed":[],"affected":"= 1.0.0; = 1.0.1; = 1.0.7","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-01T01:46:22+00:00","first_seen_at":"2026-11-02T06:51:32+00:00","triaged_at":"2026-11-02T06:53:12+00:00","updated_at":"2026-11-02T07:21:41+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-01':80C '-02':108C '-11':79C,107C '-18452':11A,14A '-2026':10A,13A '/api/webhooks/1566232728179843243/pm5rdircrrepqrba7ibaiqk1xoqliftmbaca5s8jd8nvxn5w-rs832dowhqs-g-j3n6u':67C '/sol-wallet-adapter':33C '07cf0cd27f95e20e7fe52b859d73556e78f15ca06afdcab19eb43a2616895dab':127C '1.0.0':72C '1.0.1':74C '1.0.7':100C,138C '2026':78C,106C 'account':84C,91C 'activ':156C 'adapt':7A,24C,137C 'adapter':18A 'alongsid':109C 'analysi':126C,131C 'associ':153C 'bigdevin55':92C 'canary.discord.com':66C 'canary.discord.com/api/webhooks/1566232728179843243/pm5rdircrrepqrba7ibaiqk1xoqliftmbaca5s8jd8nvxn5w-rs832dowhqs-g-j3n6u':65C 'code':2A,38C 'communic':149C 'consid':144C 'contract':111C 'contracts-upgrad':110C 'creat':95C 'cutekitten05':85C 'detail':115C 'discord':63C 'domain':152C 'edit':118C 'function':37C 'hostnam':53C 'identifi':133C 'instal':47C 'line':121C 'local':59C 'machin':51C 'mal':9A,12A 'malici':1A,19B,141C,145C,155C 'name':28C,97C 'node':43C 'notifi':70C 'npm':8A,46C,83C,139C 'openssf':129C 'os':55C 'ossf':124C 'ossf-package-analysi':123C 'packag':20B,125C,130C,148C 'pc':69C 'per':113C 'post':49C 'preinstal':40C 'preinstall.js':44C 'project':31C,132C 'project-serum':30C 'publish':76C,99C 're':94C 're-creat':93C 'remov':89C 'run':42C 'script':41C,104C 'serum':32C 'sol':5A,16A,22C,135C 'sol-wallet-adapt':4A,21C,134C 'sol-wallet-adapter':15A 'sourc':114C,122C 'take':25C 'time':60C 'unscop':27C 'upgrad':112C 'usernam':56C 'version':71C 'wallet':6A,17A,23C,136C 'webhook':64C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["solwalletadapter"],"ptokens":["adapter","sol","wallet"],"labels":["critical","malicious","npm","package"],"first_public_at":"2026-11-01T01:46:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18452","url":"https://osv.dev/vulnerability/MAL-2026-18452","severity":"critical","published_at":"2026-11-01T01:46:22+00:00","modified_at":"2026-11-02T06:30:05+00:00","first_seen_at":"2026-11-02T06:51:32+00:00","fetched_at":"2026-11-02T07:21:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}