@johnruff215-dev/solana-wallet-tracker

{"modified":"2026-10-29T00:00:00Z","schema_version":"1.7.4","id":"MAL-2026-18444","summary":"Malicious code in @johnruff215-dev/solana-wallet-tracker (npm)","details":"Malicious package. `@johnruff215-dev/solana-wallet-tracker` is an npm Solana cryptocurrency-wallet information stealer that exfiltrates wallet data to an attacker-controlled Discord webhook. The same Discord webhook endpoint (ID 1433690093175967776) is also used by the npm package `@notrainer/nobtrainer-sdk`, indicating both belong to a single actor/campaign. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicators are published at the reference below.","affected":[{"package":{"ecosystem":"npm","name":"@johnruff215-dev/solana-wallet-tracker","purl":"pkg:npm/%40johnruff215-dev%2Fsolana-wallet-tracker"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.0","1.0.1"]}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@johnruff215-dev/solana-wallet-tracker"},{"type":"WEB","url":"https://wormsign.io/portfolio/@johnruff215-dev/solana-wallet-tracker/"}],"credits":[{"name":"wormsign","type":"FINDER","contact":["https://x.com/w0rmsign"]}],"database_specific":{"iocs":{"urls":["https://discord.com/api/webhooks/1433690093175967776/"]}}}