{"id":"MAL-2026-18446","summary":"Malicious code in @notrainer/nobtrainer-sdk (npm)","details":"Malicious package. `@notrainer/nobtrainer-sdk` is an npm package that exfiltrates sensitive data on the victim host to an attacker-controlled Discord webhook. The same Discord webhook endpoint (ID 1433690093175967776) is also used by the npm package `@johnruff215-dev/solana-wallet-tracker`, indicating both belong to a single actor/campaign. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicators are published at the reference below.","modified":"2026-11-02T05:15:06.163819517Z","published":"2026-10-29T00:00:00Z","database_specific":{"iocs":{"urls":["https://discord.com/api/webhooks/1433690093175967776/"]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@notrainer/nobtrainer-sdk"},{"type":"WEB","url":"https://wormsign.io/portfolio/@notrainer/nobtrainer-sdk/"}],"affected":[{"package":{"name":"@notrainer/nobtrainer-sdk","ecosystem":"npm","purl":"pkg:npm/%40notrainer%2Fnobtrainer-sdk"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.2","1.0.3","1.0.4","1.0.5"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@notrainer/nobtrainer-sdk/MAL-2026-18446.json"}}],"schema_version":"1.9.2","credits":[{"name":"wormsign","contact":["https://x.com/w0rmsign"],"type":"FINDER"}]}