Protet Intel / npm / sol-wallet-adapter

sol-wallet-adapter 1.0.0

confirmed malicious PROTET-NPM-2026-137

Every version of this package that Protet Intel names: Is sol-wallet-adapter malicious?

Summary

Install script posts the hostname and user name of the installing machine to a Discord webhook

Details

sol-wallet-adapter 1.0.0 runs node preinstall.js as a preinstall script. The name resembles the Solana wallet adapter @project-serum/sol-wallet-adapter. The script sends an HTTPS POST to a Discord webhook (https://canary.discord.com/api/webhooks/1566232728179843243/<token>) with the message 'Run on <hostname> as <username> at <local time>' under the sender name 'PC Notifier', then writes a .preinstall-marker.json file into the package directory. The package exports no functionality of its own. axelarjs-sdk 1.0.1, sol-wallet-adapter 1.0.0 and cutekitten-test 1.0.1 ship the same script and the same webhook, and all three names were removed from the npm registry. Remove the package and treat machines that installed it as having disclosed their hostname, user name and network address to a third party.

Indicators

URLshttps://canary.discord.com/api/webhooks/1566232728179843243/

Shown as text on purpose; do not open them.

Status history

  • 2026-11-01: named as a Protet finding

Want to know if your own builds pull packages like this? Add the Protet GitHub Action.

Think this is wrong? Write to hello@protet.io and we will look at it.