{"id":"MAL-2026-18457","kind":"package","aliases":["MAL-2026-18457"],"related":[],"title":"Malicious code in bigbob22-test (npm)","description":"bigbob22-test@1.0.0 has no functional code and an empty README. Its preinstall script runs `node preinstall.js` on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook `https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U` as \"PC Notifier\". It was published by the npm account cutekitten05, which used the same script in wallet-adapter-base, axelarjs-sdk, cutekitten-test and sol-wallet-adapter on 2026-11-01.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"bigbob22-test","fixed":[],"affected":"= 1.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-01T21:27:39+00:00","first_seen_at":"2026-11-02T07:21:41+00:00","triaged_at":"2026-11-02T07:22:18+00:00","updated_at":"2026-11-02T07:24:32+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-01':95C '-11':94C '-18457':10A,13A '-2026':9A,12A '/api/webhooks/1566232728179843243/pm5rdircrrepqrba7ibaiqk1xoqliftmbaca5s8jd8nvxn5w-rs832dowhqs-g-j3n6u':59C '1.0.0':22C '2026':93C 'account':69C 'adapt':79C,91C 'axelarj':82C 'axelarjs-sdk':81C 'base':80C 'bigbob22':5A,15A,20C 'bigbob22-test':4A,14A,19C 'canary.discord.com':58C 'canary.discord.com/api/webhooks/1566232728179843243/pm5rdircrrepqrba7ibaiqk1xoqliftmbaca5s8jd8nvxn5w-rs832dowhqs-g-j3n6u':57C 'code':2A,26C 'cutekitten':85C 'cutekitten-test':84C 'cutekitten05':70C 'discord':55C 'empti':29C 'function':25C 'hostnam':45C 'instal':39C 'local':51C 'machin':43C 'mal':8A,11A 'malici':1A,17B 'node':35C 'notifi':62C 'npm':7A,38C,68C 'os':47C 'packag':18B 'pc':61C 'post':41C 'preinstal':32C 'preinstall.js':36C 'publish':65C 'readm':30C 'run':34C 'script':33C,75C 'sdk':83C 'sol':89C 'sol-wallet-adapt':88C 'test':6A,16A,21C,86C 'time':52C 'use':72C 'usernam':48C 'wallet':78C,90C 'wallet-adapter-bas':77C 'webhook':56C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["bigbob22test"],"ptokens":["bigbob22","test"],"labels":["critical","malicious","npm","package"],"first_public_at":"2026-11-01T21:27:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18457","url":"https://osv.dev/vulnerability/MAL-2026-18457","severity":"critical","published_at":"2026-11-01T21:27:39+00:00","modified_at":"2026-11-02T06:30:05+00:00","first_seen_at":"2026-11-02T07:21:41+00:00","fetched_at":"2026-11-02T07:21:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}