MAL-2026-18457: Malicious code in bigbob22-test (npm)

Published Nov 1, 2026

Updated

bigbob22-test@1.0.0 has no functional code and an empty README. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U as "PC Notifier". It was published by the npm account cutekitten05, which used the same script in wallet-adapter-base, axelarjs-sdk, cutekitten-test and sol-wallet-adapter on 2026-11-01.

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (124d3c6d5bdd1012a98468100194204703d1da8b6ba77322b9b1ea035b04c55c) The package's npm preinstall lifecycle script (preinstall.js) runs automatically on npm install and transmits installer-side identifiers to an attacker-controlled endpoint. On line 23 it reads os.hostname() and os.userInfo().username, composes a message including those values, and on line 33 POSTs the payload to a hardcoded Discord webhook at https://canary.discord.com/api/webhooks/1566232728179843243/.... The destination is a Discord webhook (not the package publisher's infrastructure), the behavior is undocumented, and no opt-out is provided. Installing this package causes host and user identity information to be sent to a third-party endpoint controlled by whoever created the webhook.

Affected Software

1 affected component

npm/bigbob22-test=1.0.0

Event History

Nov 1, 2026

Advisory Published

via OSV·09:27 PM

Data Sourced

via OSV·09:27 PM

DescriptionAffected Software

Frequently Asked Questions

What installation activity triggers the data transmission?

The package's preinstall lifecycle script runs automatically during npm install. It executes node preinstall.js and sends the hostname, OS username, and local time to a hardcoded Discord webhook.

Which systems are exposed?

Any machine where bigbob22-test@1.0.0 is installed through npm is exposed to the installer-side collection. The package has no functional code, so the reported behavior is tied to installation rather than use of its application features.

What should be checked if this package may have been installed?

Check dependency manifests, lockfiles, npm installation history, and build or CI logs for bigbob22-test@1.0.0. Also review outbound requests to the listed Discord webhook and treat the affected host's hostname, OS username, and installation time as potentially disclosed.

What can be done before the package is removed from affected workflows?

Avoid installing bigbob22-test@1.0.0 and remove it from direct or transitive dependency paths where possible. If installation cannot be avoided immediately, prevent the npm lifecycle script from running and restrict outbound access to the hardcoded Discord webhook.

MAL-2026-18457: Malicious code in bigbob22-test (npm)

Affected Software

Event History

Frequently Asked Questions

What installation activity triggers the data transmission?

Which systems are exposed?

What should be checked if this package may have been installed?

What can be done before the package is removed from affected workflows?

Company

Resources

Contact

Frequently Asked Questions

What installation activity triggers the data transmission?

Which systems are exposed?

What should be checked if this package may have been installed?

What can be done before the package is removed from affected workflows?