Protet Intel / npm / cutekitten-test
cutekitten-test 1.0.1
Every version of this package that Protet Intel names: Is cutekitten-test malicious?
Summary
Install script posts the hostname and user name of the installing machine to a Discord webhook
Details
cutekitten-test 1.0.1 runs node preinstall.js as a preinstall script. Its description states that the hook posts the installing machine's hostname and username to a Discord webhook. The script sends an HTTPS POST to a Discord webhook (https://canary.discord.com/api/webhooks/1566232728179843243/<token>) with the message 'Run on <hostname> as <username> at <local time>' under the sender name 'PC Notifier', then writes a .preinstall-marker.json file into the package directory. The package exports no functionality of its own. axelarjs-sdk 1.0.1, sol-wallet-adapter 1.0.0 and cutekitten-test 1.0.1 ship the same script and the same webhook, and all three names were removed from the npm registry. Remove the package and treat machines that installed it as having disclosed their hostname, user name and network address to a third party.
Indicators
URLshttps://canary.discord.com/api/webhooks/1566232728179843243/
Records
- OSV record PROTET-NPM-2026-138
- Feeds: NDJSON, Atom
Status history
- 2026-11-01: named as a Protet finding