If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
bigbob22-test@1.0.0 has no functional code and an empty README. Its preinstall script runs `node preinstall.js` on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook `https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U` as "PC Notifier". It was published by the npm account cutekitten05, which used the same script in wallet-adapter-base, axelarjs-sdk, cutekitten-test and sol-wallet-adapter on 2026-11-01.
---
_-= Per source details. Do not edit below this line.=-_
Source: amazon-inspector (124d3c6d5bdd1012a98468100194204703d1da8b6ba77322b9b1ea035b04c55c)
The package's npm preinstall lifecycle script (preinstall.js) runs automatically on `npm install` and transmits installer-side identifiers to an attacker-controlled endpoint. On line 23 it reads `os.hostname()` and `os.userInfo().username`, composes a message including those values, and on line 33 POSTs the payload to a hardcoded Discord webhook at https://canary.discord.com/api/webhooks/1566232728179843243/.... The destination is a Discord webhook (not the package publisher's infrastructure), the behavior is undocumented, and no opt-out is provided. Installing this package causes host and user identity information to be sent to a third-party endpoint controlled by whoever created the webhook.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://canary[.]discord[.]com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U other packages →