sol-wallet-adapter

GHSA-j62h-2r3r-ggh9

Malicious code in sol-wallet-adapter (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

sol-wallet-adapter takes the unscoped name of @project-serum/sol-wallet-adapter and has no functional code. Its preinstall script runs `node preinstall.js` on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook `https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U` as "PC Notifier". Versions 1.0.0 and 1.0.1 were published on 2026-11-01 by the npm account cutekitten05; after they were removed, the account bigdevin55 re-created the name and published 1.0.7 with the same script on 2026-11-02, alongside contracts-upgradeable.## Source: ossf-package-analysis (07cf0cd27f95e20e7fe52b859d73556e78f15ca06afdcab19eb43a2616895dab)
The OpenSSF Package Analysis project identified 'sol-wallet-adapter' @ 1.0.7 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/af37b0d0bcd7755fbd3de21aea4d43feaa29fc85/osv/malicious/npm/sol-wallet-adapter/MAL-2026-18452.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/af37b0d0bcd7755fbd3de21aea4d43feaa29fc85/osv/malicious/npm/sol-wallet-adapter/MAL-2026-18452.json
- https://www.npmjs.com/package/sol-wallet-adapter
- https://github.com/advisories/GHSA-j62h-2r3r-ggh9

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.