wallet-adapter-base is malicious. Its code runs at install and can read the secrets of the machine.

npm

Details

Safe
after 1.0.0
Advisories
1 in 120 days

Used by

Stacks that pull this package.

Solana Wallet Adapter

Alerts(1)

Malicious code in wallet-adapter-base (npm)

wallet-adapter-base · 2 Nov

Critical
Conditions could not be extracted

Source summary

wallet-adapter-base takes the unscoped name of @solana/wallet-adapter-base and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U as "PC Notifier". It was published by the npm account cutekitten05, which published axelarjs-sdk, cutekitten-test, bigbob22-test and sol-wallet-adapter with the same script on 2026-11-01. --- Credit…

Affected
wallet-adapter-base 1.0.0
Fixed in
after 1.0.0
ID
GHSA-r89f-jjgp-3q97
Open the alert