Malicious code in sol-wallet-adapter (npm).

CriticalGHSA-j62h-2r3r-ggh92 Nov · today
Source

Does it affect you?

Not extracted

The conditions could not be extracted from the source.

sol-wallet-adapter takes the unscoped name of @project-serum/sol-wallet-adapter and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U as "PC Notifier". Versions 1.0.0 and 1.0.1 were published on 2026-11-01 by the npm account cutekitten05; after they were removed, the account bigdevin55 re-created the name and published 1.0.7 with the…

SourcesGitHub malware advisory

Timeline

2 Nov
1 hfrom publication to Patchwire
  1. Published in the GitHub database2 Nov, 06:31 UTC
  2. Seen by Patchwire +1 h2 Nov, 07:46 UTC
sol-wallet-adapterafter 1.0.7after 1.0.1after 1.0.0

Packages

sol-wallet-adapter

Stacks

Solana Wallet Adapter