bigbob22-test

{"schema_version":"1.7.4","id":"MAL-2026-18457","published":"2026-11-01T21:27:39Z","modified":"2026-11-02T21:12:26.275073264Z","summary":"Malicious code in bigbob22-test (npm)","details":"bigbob22-test@1.0.0 has no functional code and an empty README. Its preinstall script runs `node preinstall.js` on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook `https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U` as \"PC Notifier\". It was published by the npm account cutekitten05, which used the same script in wallet-adapter-base, axelarjs-sdk, cutekitten-test and sol-wallet-adapter on 2026-11-01.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (124d3c6d5bdd1012a98468100194204703d1da8b6ba77322b9b1ea035b04c55c)\nThe package's npm preinstall lifecycle script (preinstall.js) runs automatically on `npm install` and transmits installer-side identifiers to an attacker-controlled endpoint. On line 23 it reads `os.hostname()` and `os.userInfo().username`, composes a message including those values, and on line 33 POSTs the payload to a hardcoded Discord webhook at https://canary.discord.com/api/webhooks/1566232728179843243/.... The destination is a Discord webhook (not the package publisher's infrastructure), the behavior is undocumented, and no opt-out is provided. Installing this package causes host and user identity information to be sent to a third-party endpoint controlled by whoever created the webhook.\n","affected":[{"package":{"name":"bigbob22-test","ecosystem":"npm"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"preinstall.js","sha256":"d2709b8afcf5e5e2859d0b56c8f119b73c98fc56c32fb072baea5b51b1cc3554","tlsh":"2341a6c784f019301a57c2ec853346053a35ce032bdaed23f69d03665f8846ec2b2ee9"}],"package_integrity":[{"filename":"bigbob22-test-1.0.0.tgz","hashes":{"sha1":"f15168d1e18e982a148172f7e8bd5995b0ceaf92","sha512_sri":"sha512-kmv3U//RDwwKH2RzvMDhvvAVAAhfZen+sE1ZDWxjxLcgxn9YMFf/pAE+WaOzT7gfadUlEari5thvkqGaN1vReA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigbob22-test"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/bigbob22-test/v/1.0.0"}],"database_specific":{"iocs":{"files":[{"digests":{"sha256":"d45c8c679c1e94212a39e95a5a1a6f217b3b294c9c95c3d61a84ef93027541ac"},"note":"preinstall runs `node preinstall.js`, which POSTs hostname and username to a Discord webhook (bigbob22-test@1.0.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"d2709b8afcf5e5e2859d0b56c8f119b73c98fc56c32fb072baea5b51b1cc3554"},"note":"Executed by the preinstall script of bigbob22-test@1.0.0.","paths":["preinstall.js"],"source":"PACKAGE_ARCHIVE"}],"urls":["https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-022485","import_time":"2026-11-02T21:10:54.61580879Z","modified_time":"2026-11-02T20:56:11Z","sha256":"124d3c6d5bdd1012a98468100194204703d1da8b6ba77322b9b1ea035b04c55c","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}