Protet Intel / npm / sol-wallet-adapter
sol-wallet-adapter 1.0.0
Every version of this package that Protet Intel names: Is sol-wallet-adapter malicious?
Summary
Install script posts the hostname and user name of the installing machine to a Discord webhook
Details
sol-wallet-adapter 1.0.0 runs node preinstall.js as a preinstall script. The name resembles the Solana wallet adapter @project-serum/sol-wallet-adapter. The script sends an HTTPS POST to a Discord webhook (https://canary.discord.com/api/webhooks/1566232728179843243/<token>) with the message 'Run on <hostname> as <username> at <local time>' under the sender name 'PC Notifier', then writes a .preinstall-marker.json file into the package directory. The package exports no functionality of its own. axelarjs-sdk 1.0.1, sol-wallet-adapter 1.0.0 and cutekitten-test 1.0.1 ship the same script and the same webhook, and all three names were removed from the npm registry. Remove the package and treat machines that installed it as having disclosed their hostname, user name and network address to a third party.
Indicators
URLshttps://canary.discord.com/api/webhooks/1566232728179843243/
Records
- OSV record PROTET-NPM-2026-137
- Feeds: NDJSON, Atom
Status history
- 2026-11-01: named as a Protet finding