Protet Intel / npm / wallet-adapter-base
wallet-adapter-base 1.0.0
confirmed malicious
PROTET-NPM-2026-171
Every version of this package that Protet Intel names: Is wallet-adapter-base malicious?
Details
wallet-adapter-base takes the unscoped name of @solana/wallet-adapter-base. Its preinstall script runs 'node preinstall.js' on npm install, which sends the machine's hostname, the OS user name and the local time by HTTPS POST to a hardcoded Discord webhook. It has no functional code. Remove the package and treat the hostnames and user names of affected machines as disclosed. Also listed as MAL-2026-18459.
Records
- OSV record PROTET-NPM-2026-171
- Also reported in OSV as MAL-2026-18459
- Feeds: NDJSON, Atom
Status history
- 2026-11-07: named as a Protet finding