{
 "affected": [
  {
   "package": {
    "ecosystem": "npm",
    "name": "axelarjs-sdk"
   },
   "versions": [
    "1.0.1"
   ]
  }
 ],
 "aliases": [],
 "credits": [
  {
   "contact": [
    "https://protet.io/intel/npm/axelarjs-sdk/1.0.1"
   ],
   "name": "Protet",
   "type": "FINDER"
  }
 ],
 "details": "axelarjs-sdk 1.0.1 runs node preinstall.js as a preinstall script. The name resembles the Axelar network SDK (@axelar-network/axelarjs-sdk). The script sends an HTTPS POST to a Discord webhook (https://canary.discord.com/api/webhooks/1566232728179843243/<token>) with the message 'Run on <hostname> as <username> at <local time>' under the sender name 'PC Notifier', then writes a .preinstall-marker.json file into the package directory. The package exports no functionality of its own. axelarjs-sdk 1.0.1, sol-wallet-adapter 1.0.0 and cutekitten-test 1.0.1 ship the same script and the same webhook, and all three names were removed from the npm registry. Remove the package and treat machines that installed it as having disclosed their hostname, user name and network address to a third party.",
 "id": "PROTET-NPM-2026-136",
 "modified": "2026-11-01T08:29:02Z",
 "published": "2026-11-01T08:29:02Z",
 "references": [
  {
   "type": "REPORT",
   "url": "https://protet.io/intel/npm/axelarjs-sdk/1.0.1"
  }
 ],
 "schema_version": "1.6.0",
 "summary": "Install script posts the hostname and user name of the installing machine to a Discord webhook"
}