{"id":"MAL-2026-18459","kind":"package","aliases":["MAL-2026-18459"],"related":[],"title":"Malicious code in wallet-adapter-base (npm)","description":"wallet-adapter-base takes the unscoped name of @solana/wallet-adapter-base and has no functional code. Its preinstall script runs `node preinstall.js` on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook `https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U` as \"PC Notifier\". It was published by the npm account cutekitten05, which published axelarjs-sdk, cutekitten-test, bigbob22-test and sol-wallet-adapter with the same script on 2026-11-01.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wallet-adapter-base","fixed":[],"affected":"= 1.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-01T21:33:18+00:00","first_seen_at":"2026-11-02T07:21:41+00:00","triaged_at":"2026-11-02T07:22:18+00:00","updated_at":"2026-11-02T07:24:32+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-01':99C '-11':98C '-18459':11A,14A '-2026':10A,13A '/api/webhooks/1566232728179843243/pm5rdircrrepqrba7ibaiqk1xoqliftmbaca5s8jd8nvxn5w-rs832dowhqs-g-j3n6u':64C '2026':97C 'account':74C 'adapt':6A,23C,91C 'adapter':17A 'axelarj':79C 'axelarjs-sdk':78C 'base':7A,18A,24C 'bigbob22':85C 'bigbob22-test':84C 'canary.discord.com':63C 'canary.discord.com/api/webhooks/1566232728179843243/pm5rdircrrepqrba7ibaiqk1xoqliftmbaca5s8jd8nvxn5w-rs832dowhqs-g-j3n6u':62C 'code':2A,35C 'cutekitten':82C 'cutekitten-test':81C 'cutekitten05':75C 'discord':60C 'function':34C 'hostnam':50C 'instal':44C 'local':56C 'machin':48C 'mal':9A,12A 'malici':1A,19B 'name':28C 'node':40C 'notifi':67C 'npm':8A,43C,73C 'os':52C 'packag':20B 'pc':66C 'post':46C 'preinstal':37C 'preinstall.js':41C 'publish':70C,77C 'run':39C 'script':38C,95C 'sdk':80C 'sol':89C 'sol-wallet-adapt':88C 'solana/wallet-adapter-base':30C 'take':25C 'test':83C,86C 'time':57C 'unscop':27C 'usernam':53C 'wallet':5A,16A,22C,90C 'wallet-adapter-bas':4A,21C 'wallet-adapter-base':15A 'webhook':61C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["walletadapterbase"],"ptokens":["adapter","base","wallet"],"labels":["critical","malicious","npm","package"],"first_public_at":"2026-11-01T21:33:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18459","url":"https://osv.dev/vulnerability/MAL-2026-18459","severity":"critical","published_at":"2026-11-01T21:33:18+00:00","modified_at":"2026-11-02T06:30:05+00:00","first_seen_at":"2026-11-02T07:21:41+00:00","fetched_at":"2026-11-02T07:21:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}