cutekitten-test

{"modified":"2026-11-02T03:23:34Z","published":"2026-11-01T01:32:20Z","schema_version":"1.7.4","id":"MAL-2026-18458","summary":"Malicious code in cutekitten-test (npm)","details":"cutekitten-test@1.0.1 describes itself as a security test package for a school project and has no functional code. Its preinstall script runs `node preinstall.js` on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook `https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U` as \"PC Notifier\". It was published by the npm account cutekitten05, which used the same script in wallet-adapter-base, axelarjs-sdk, bigbob22-test and sol-wallet-adapter on 2026-11-01.","affected":[{"package":{"ecosystem":"npm","name":"cutekitten-test"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cutekitten-test"}],"credits":[{"name":"InvisiRisk, Inc.","type":"FINDER","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"]}],"database_specific":{"iocs":{"files":[{"digests":{"sha256":"09503707421841093b4923ef405aa9655b70e8dc55d2e6f45fa2bc976bbb73b7"},"note":"preinstall runs `node preinstall.js`, which POSTs hostname and username to a Discord webhook (cutekitten-test@1.0.1).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"7993cb7fb7b4ec406bd47343b2a1ee715d08a0f32960a6093fb41dc518d4f436"},"note":"Executed by the preinstall script of cutekitten-test@1.0.1.","paths":["preinstall.js"],"source":"PACKAGE_ARCHIVE"}],"urls":["https://canary.discord.com/api/webhooks/1566232728179843243/pM5rDIrCRrEpQRbA7ibaiQk1XOQlIftmBacA5s8jD8NvXn5W-rS832DOWHQS-G-j3N6U"]}}}