{"id":"MAL-2026-18444","summary":"Malicious code in @johnruff215-dev/solana-wallet-tracker (npm)","details":"Malicious package. `@johnruff215-dev/solana-wallet-tracker` is an npm Solana cryptocurrency-wallet information stealer that exfiltrates wallet data to an attacker-controlled Discord webhook. The same Discord webhook endpoint (ID 1433690093175967776) is also used by the npm package `@notrainer/nobtrainer-sdk`, indicating both belong to a single actor/campaign. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicators are published at the reference below.","modified":"2026-11-02T05:00:05.973371842Z","published":"2026-10-29T00:00:00Z","database_specific":{"iocs":{"urls":["https://discord.com/api/webhooks/1433690093175967776/"]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@johnruff215-dev/solana-wallet-tracker"},{"type":"WEB","url":"https://wormsign.io/portfolio/@johnruff215-dev/solana-wallet-tracker/"}],"affected":[{"package":{"name":"@johnruff215-dev/solana-wallet-tracker","ecosystem":"npm","purl":"pkg:npm/%40johnruff215-dev%2Fsolana-wallet-tracker"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.0","1.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@johnruff215-dev/solana-wallet-tracker/MAL-2026-18444.json"}}],"schema_version":"1.9.2","credits":[{"name":"wormsign","contact":["https://x.com/w0rmsign"],"type":"FINDER"}]}