sol-wallet-adapter (npm) · Malicious Code
Affects sol-wallet-adapterSource GCVE Database
Malicious package : remove sol-wallet-adapter and rotate any secrets on hosts that installed it.
Data as of 2 Nov 2026, 07:46 UTC
Malicious package
Published to npm · OSV MAL-2026-18452
What to do
Remove sol-wallet-adapter from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmsol-wallet-adapter | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'sol-wallet-adapter' versions 1.0.0, 1.0.1, and 1.0.7 are malicious. These versions contain no functional code but execute a preinstall script that sends the machine's hostname, OS username, and local time to a Discord webhook, potentially leaking sensitive environment information. The package was published by suspicious accounts and communicates with a domain linked to malicious activity.