{"id":"MAL-2026-18456","kind":"package","aliases":["MAL-2026-18456"],"related":[],"title":"Malicious code in axelarjs-sdk (npm)","description":"axelarjs-sdk@1.0.1 takes the unscoped name of @axelar-network/axelarjs-sdk and has no functional code. Its preinstall script runs `node preinstall.js` on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook `https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U` as \"PC Notifier\". It was published by the npm account cutekitten05, which published wallet-adapter-base, cutekitten-test, bigbob22-test and sol-wallet-adapter with the same script on 2026-11-01.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"axelarjs-sdk","fixed":[],"affected":"= 1.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-01T02:23:13+00:00","first_seen_at":"2026-11-02T07:21:41+00:00","triaged_at":"2026-11-02T07:22:18+00:00","updated_at":"2026-11-02T07:24:32+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-01':101C '-11':100C '-18456':10A,13A '-2026':9A,12A '/api/webhooks/1566232728179843243/pm5rdircrrepqrba7ibaiqk1xoqliftmbaca5s8jd8nvxn5w-rs832dowhqs-g-j3n6u':65C '/axelarjs-sdk':31C '1.0.1':22C '2026':99C 'account':75C 'adapt':81C,93C 'axelar':29C 'axelar-network':28C 'axelarj':5A,20C 'axelarjs':15A 'axelarjs-sdk':4A,14A,19C 'base':82C 'bigbob22':87C 'bigbob22-test':86C 'canary.discord.com':64C 'canary.discord.com/api/webhooks/1566232728179843243/pm5rdircrrepqrba7ibaiqk1xoqliftmbaca5s8jd8nvxn5w-rs832dowhqs-g-j3n6u':63C 'code':2A,36C 'cutekitten':84C 'cutekitten-test':83C 'cutekitten05':76C 'discord':61C 'function':35C 'hostnam':51C 'instal':45C 'local':57C 'machin':49C 'mal':8A,11A 'malici':1A,17B 'name':26C 'network':30C 'node':41C 'notifi':68C 'npm':7A,44C,74C 'os':53C 'packag':18B 'pc':67C 'post':47C 'preinstal':38C 'preinstall.js':42C 'publish':71C,78C 'run':40C 'script':39C,97C 'sdk':6A,16A,21C 'sol':91C 'sol-wallet-adapt':90C 'take':23C 'test':85C,88C 'time':58C 'unscop':25C 'usernam':54C 'wallet':80C,92C 'wallet-adapter-bas':79C 'webhook':62C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["axelarjssdk"],"ptokens":["axelarjs","sdk"],"labels":["critical","malicious","npm","package"],"first_public_at":"2026-11-01T02:23:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18456","url":"https://osv.dev/vulnerability/MAL-2026-18456","severity":"critical","published_at":"2026-11-01T02:23:13+00:00","modified_at":"2026-11-02T06:30:05+00:00","first_seen_at":"2026-11-02T07:21:41+00:00","fetched_at":"2026-11-02T07:21:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}