Malicious code in wallet-adapter-base (npm).

CriticalGHSA-r89f-jjgp-3q972 Nov · today
Source

Does it affect you?

Not extracted

The conditions could not be extracted from the source.

wallet-adapter-base takes the unscoped name of @solana/wallet-adapter-base and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U as "PC Notifier". It was published by the npm account cutekitten05, which published axelarjs-sdk, cutekitten-test, bigbob22-test and sol-wallet-adapter with the same script on 2026-11-01. --- Credit…

SourcesGitHub malware advisory

Timeline

2 Nov
1 hfrom publication to Patchwire
  1. Published in the GitHub database2 Nov, 06:31 UTC
  2. Seen by Patchwire +1 h2 Nov, 07:46 UTC
wallet-adapter-baseafter 1.0.0

Packages

wallet-adapter-base

Stacks

Solana Wallet Adapter