MAL-2026-18459: Malicious code in wallet-adapter-base (npm)

Published Nov 1, 2026

Updated

wallet-adapter-base takes the unscoped name of @solana/wallet-adapter-base and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U as "PC Notifier". It was published by the npm account cutekitten05, which published axelarjs-sdk, cutekitten-test, bigbob22-test and sol-wallet-adapter with the same script on 2026-11-01.

--- -= Per source details. Do not edit below this line.=-

Source: ghsa-malware (bde7babd223d526922c03a77b46c3cb5a7ee7e05027dd66e3f630520ad6c53ab) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Affected Software

1 affected component

npm/wallet-adapter-base*

Event History

Nov 1, 2026

Advisory Published

via OSV·09:33 PM

Data Sourced

via OSV·09:33 PM

DescriptionAffected Software

Frequently Asked Questions

What systems are exposed to this package's behavior?

Any computer where the package is installed or run is considered fully compromised according to the source. The preinstall script executes during npm installation and sends the machine hostname, OS username, and local time to a Discord webhook.

Does installation alone trigger the malicious activity?

Yes. The package defines a preinstall script that runs node preinstall.js on npm install, so the reported data collection occurs as part of installation.

What should teams do if this package was installed?

Rotate all secrets and keys stored on the affected computer immediately, using a different computer. Remove the package, but do not assume removal eliminates malicious software or restores trust in the host.

Are there related package names that should be investigated?

The same npm account, cutekitten05, published axelarjs-sdk, cutekitten-test, bigbob22-test, and sol-wallet-adapter with the same script on 2026-11-01. These packages should be included in an exposure review.

MAL-2026-18459: Malicious code in wallet-adapter-base (npm)

Affected Software

Event History

Frequently Asked Questions

What systems are exposed to this package's behavior?

Does installation alone trigger the malicious activity?

What should teams do if this package was installed?

Are there related package names that should be investigated?

Company

Resources

Contact

Frequently Asked Questions

What systems are exposed to this package's behavior?

Does installation alone trigger the malicious activity?

What should teams do if this package was installed?

Are there related package names that should be investigated?