MAL-2026-18452

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sol-wallet-adapter/MAL-2026-18452.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18452
Published
2026-11-01T01:46:22Z
Modified
2026-11-02T06:30:05Z
Summary
Malicious code in sol-wallet-adapter (npm)
Details

sol-wallet-adapter takes the unscoped name of @project-serum/sol-wallet-adapter and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U as "PC Notifier". Versions 1.0.0 and 1.0.1 were published on 2026-11-01 by the npm account cutekitten05; after they were removed, the account bigdevin55 re-created the name and published 1.0.7 with the same script on 2026-11-02, alongside contracts-upgradeable.

-= Per source details. Do not edit below this line.=-

Source: ossf-package-analysis (07cf0cd27f95e20e7fe52b859d73556e78f15ca06afdcab19eb43a2616895dab)

The OpenSSF Package Analysis project identified 'sol-wallet-adapter' @ 1.0.7 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "iocs":  {
        "files":  [
            {
                "digests":  {
                    "sha256":  "dfeda90b9284e4ba7c1dc613aec4ed9552eb47893292bdce405b266032c904c2"
                },
                "note":  "preinstall runs `node preinstall.js`, which POSTs hostname and username to a Discord webhook (sol-wallet-adapter@1.0.0).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "7993cb7fb7b4ec406bd47343b2a1ee715d08a0f32960a6093fb41dc518d4f436"
                },
                "note":  "Executed by the preinstall script of sol-wallet-adapter@1.0.0.",
                "paths":  [
                    "preinstall.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "062e68a9970cf8d878f1f02bd53b8bdb152c54db57b381ee81b24200e49a09e9"
                },
                "note":  "preinstall runs `node preinstall.js`, which POSTs hostname and username to a Discord webhook (sol-wallet-adapter@1.0.1).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "7993cb7fb7b4ec406bd47343b2a1ee715d08a0f32960a6093fb41dc518d4f436"
                },
                "note":  "Executed by the preinstall script of sol-wallet-adapter@1.0.1.",
                "paths":  [
                    "preinstall.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "5ead50b074ac5e37fc015cce6fb5436898eb9dbd41d08043156d28a8f04c8fb6"
                },
                "note":  "preinstall runs `node preinstall.js`, which POSTs hostname and username to a Discord webhook (sol-wallet-adapter@1.0.7).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "d2709b8afcf5e5e2859d0b56c8f119b73c98fc56c32fb072baea5b51b1cc3554"
                },
                "note":  "Executed by the preinstall script of sol-wallet-adapter@1.0.7.",
                "paths":  [
                    "preinstall.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ],
        "urls":  [
            "https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U"
        ]
    },
    "malicious-packages-origins":  [
        {
            "import_time":  "2026-11-02T06:26:01.467375362Z",
            "modified_time":  "2026-11-02T03:21:51Z",
            "sha256":  "07cf0cd27f95e20e7fe52b859d73556e78f15ca06afdcab19eb43a2616895dab",
            "source":  "ossf-package-analysis",
            "versions":  [
                "1.0.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / sol-wallet-adapter

Package

Name
sol-wallet-adapter
View open source insights on deps.dev
Purl
pkg:npm/sol-wallet-adapter

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.7

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sol-wallet-adapter/MAL-2026-18452.json"