{"id":"MAL-2026-18443","summary":"Malicious code in wallet-tracking (PyPI)","details":"Malicious package. `wallet-tracking` is a PyPI cryptocurrency-wallet information stealer. It collects wallet data on the victim host and exfiltrates it to an attacker-controlled Discord webhook. The source also still contains an unconfigured placeholder webhook URL (.../api/webhooks/YOUR_URL) beside the live one, indicating a copy-paste stealer template. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. First observed by wormsign on 2026-05-30. Full indicators are published at the reference below.","modified":"2026-11-02T04:45:03.386245159Z","published":"2026-10-29T00:00:00Z","database_specific":{"iocs":{"urls":["https://discordapp.com/api/webhooks/1442389288108036187/"]}},"references":[{"type":"PACKAGE","url":"https://pypi.org/project/wallet-tracking/"},{"type":"WEB","url":"https://wormsign.io/portfolio/wallet-tracking/"}],"affected":[{"package":{"name":"wallet-tracking","ecosystem":"PyPI","purl":"pkg:pypi/wallet-tracking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0","1.0.1","1.0.3","1.0.4","1.0.5","1.0.6"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/wallet-tracking/MAL-2026-18443.json"}}],"schema_version":"1.9.2","credits":[{"name":"wormsign","contact":["https://x.com/w0rmsign"],"type":"FINDER"}]}