{"id":"MAL-2026-18458","kind":"package","aliases":["MAL-2026-18458"],"related":[],"title":"Malicious code in cutekitten-test (npm)","description":"cutekitten-test@1.0.1 describes itself as a security test package for a school project and has no functional code. Its preinstall script runs `node preinstall.js` on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook `https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U` as \"PC Notifier\". It was published by the npm account cutekitten05, which used the same script in wallet-adapter-base, axelarjs-sdk, bigbob22-test and sol-wallet-adapter on 2026-11-01.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"cutekitten-test","fixed":[],"affected":"= 1.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-01T01:32:20+00:00","first_seen_at":"2026-11-02T07:21:41+00:00","triaged_at":"2026-11-02T07:22:18+00:00","updated_at":"2026-11-02T07:24:32+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-01':103C '-11':102C '-18458':10A,13A '-2026':9A,12A '/api/webhooks/1566232728179843243/pm5rdircrrepqrba7ibaiqk1xoqliftmbaca5s8jd8nvxn5w-rs832dowhqs-g-j3n6u':67C '1.0.1':22C '2026':101C 'account':77C 'adapt':87C,99C 'axelarj':90C 'axelarjs-sdk':89C 'base':88C 'bigbob22':93C 'bigbob22-test':92C 'canary.discord.com':66C 'canary.discord.com/api/webhooks/1566232728179843243/pm5rdircrrepqrba7ibaiqk1xoqliftmbaca5s8jd8nvxn5w-rs832dowhqs-g-j3n6u':65C 'code':2A,38C 'cutekitten':5A,15A,20C 'cutekitten-test':4A,14A,19C 'cutekitten05':78C 'describ':23C 'discord':63C 'function':37C 'hostnam':53C 'instal':47C 'local':59C 'machin':51C 'mal':8A,11A 'malici':1A,17B 'node':43C 'notifi':70C 'npm':7A,46C,76C 'os':55C 'packag':18B,29C 'pc':69C 'post':49C 'preinstal':40C 'preinstall.js':44C 'project':33C 'publish':73C 'run':42C 'school':32C 'script':41C,83C 'sdk':91C 'secur':27C 'sol':97C 'sol-wallet-adapt':96C 'test':6A,16A,21C,28C,94C 'time':60C 'use':80C 'usernam':56C 'wallet':86C,98C 'wallet-adapter-bas':85C 'webhook':64C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["cutekittentest"],"ptokens":["cutekitten","test"],"labels":["critical","malicious","npm","package"],"first_public_at":"2026-11-01T01:32:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18458","url":"https://osv.dev/vulnerability/MAL-2026-18458","severity":"critical","published_at":"2026-11-01T01:32:20+00:00","modified_at":"2026-11-02T06:30:05+00:00","first_seen_at":"2026-11-02T07:21:41+00:00","fetched_at":"2026-11-02T07:21:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}