Malicious. sol-wallet-adapater is a typosquat copy of celest-browser whose postinstall downloads a disguised shellcode loader from the anonymous file host peerbox.cloud and runs it as its "Chromium binary" on first use.
sol-wallet-adapater 1.0.0 is malicious: a supply-chain attack — installing it downloads a file from an anonymous file host into the home directory, makes it executable, and the package runs it as its browser the first time the library is used. The file behind that download is a shellcode loader named chromedriver.exe, not the "custom patched Chromium binary" the README claims. The package name is one character away from the Solana package name sol-wallet-adapter and the description begins "Solana Wallet Adapter", but the package contains no wallet and no Solana code: it is a republish of the npm package celest-browser 1.0.0 (published November 11, 2026 by npm user stevendolerhas) with the download URL changed. npm user fishrikehenny published this one on November 12, 2026 at 21:40 UTC, the same day the account was created; npm still served it at this review, less than half an hour after publication.
What sol-wallet-adapater does
Past the name and the description, the package is a browser-automation library: get, post, fetch and openPage drive a web page through puppeteer-core and return its rendered HTML, documented as a way to make an automated browser look like a normal desktop Chrome. Its package.json declares a postinstall hook (package.json:13), so npm install runs scripts/install.js, which calls the package's downloader (scripts/install.js:8-17) unless CELEST_SKIP_DOWNLOAD=1 is set or ~/.celest/bin/chrome already exists. The downloader fetches https://peerbox.cloud/s/nSXWTpGsFd4qmzNJqWYs4w with the platform and architecture appended (src/download.js:8, src/download.js:51), streams whatever that address returns to ~/.celest/bin/chrome.tmp, renames it to chrome (chrome.exe on Windows) and makes it executable (src/download.js:75-93). No hash is pinned and no signature is verified anywhere in the package. The first call to get, post, fetch or openPage passes that file to puppeteer-core as the browser to launch (src/browser.js:23-27): the package's own code executes the downloaded file.
peerbox.cloud is Peerbox, an anonymous seedbox and file host — no email, no password, paid in cryptocurrency. Nothing in the package or any project page names it, and its shares are open to anyone holding the link. The share this URL names holds a single file, chromedriver.exe, 91,842 bytes, served at the share's direct-download address. That is not a Chromium build (over a hundred megabytes) and not a real chromedriver (about ten megabytes): it is an obfuscated Windows command file whose text, decoded, builds a WScript/PowerShell command that reads a file of bytes, reverses it, copies it into memory allocated read-write-execute (VirtualAlloc with 12288/4) and starts it as a thread — a shellcode loader. The URL the package ships is the share's page form, which returns the share's web page rather than the file, so a plain install stores page text as an executable file and the first launch fails; the celest-browser package this one copies points at the same host's direct-download form, which serves the loader itself. Whichever form arrives, the package is built to fetch a program from a link its user never chose, make it executable, and run it.
What the code does
- package.json:13 —
postinstall: node scripts/install.js, so the download happens on npm install
- scripts/install.js:4-17 — skips only if
CELEST_SKIP_DOWNLOAD=1 or ~/.celest/bin/chrome exists; otherwise calls the package's downloader
- src/download.js:8 — download source:
https://peerbox.cloud/s/nSXWTpGsFd4qmzNJqWYs4w (Peerbox, an anonymous file host)
- src/download.js:51 — fetched as
${BINARY_API}?platform=${process.platform}&arch=${process.arch}; no hash pinned, no signature verified
- src/download.js:78-89 — whatever arrives is streamed to
~/.celest/bin/chrome.tmp and renamed to chrome / chrome.exe
- src/download.js:93 —
chmod 755: the downloaded file is made executable on every platform
- src/browser.js:23-27 — the downloaded file is passed as
executablePath to puppeteer-core and executed on first use
- README.md:3 — the file is documented as a "custom patched Chromium binary"
Timeline (UTC)
| When | What |
|---|
| 11/12/26 21:38 | version 0.0.0-stage published: a 370-byte placeholder with no install script, by the same new account |
| 11/12/26 21:40 | version 1.0.0 published, with the postinstall download and the launch-on-first-use chain |
| 11/12/26 22:03 | this review: npm still serves 1.0.0, less than half an hour after publication; peerbox.cloud still serves the share, and its direct-download form still serves the 91,842-byte chromedriver.exe |
If you installed it
Uninstall it (npm rm sol-wallet-adapater), and remove celest-browser too if it is present: it is the same code with a URL that fetches the loader directly. Delete the ~/.celest directory — the downloaded chrome or chrome.exe, chrome.tmp, and the .downloading lock file. The install script only downloads; the downloaded file is executed when the library is first used, so an install that was never used has not run it. If you called get, post, fetch or openPage on a machine where the download delivered the loader, treat that machine as compromised: look for powershell.exe or wscript.exe started from ~/.celest/bin, for outbound connections to peerbox.cloud, and for new scheduled tasks; treat any credentials, wallet files or keys handled on that machine as exposed, and rotate them.
