@notrainer/nobtrainer-sdk

{"modified":"2026-10-29T00:00:00Z","schema_version":"1.7.4","id":"MAL-2026-18446","summary":"Malicious code in @notrainer/nobtrainer-sdk (npm)","details":"Malicious package. `@notrainer/nobtrainer-sdk` is an npm package that exfiltrates sensitive data on the victim host to an attacker-controlled Discord webhook. The same Discord webhook endpoint (ID 1433690093175967776) is also used by the npm package `@johnruff215-dev/solana-wallet-tracker`, indicating both belong to a single actor/campaign. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicators are published at the reference below.","affected":[{"package":{"ecosystem":"npm","name":"@notrainer/nobtrainer-sdk","purl":"pkg:npm/%40notrainer%2Fnobtrainer-sdk"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.2","1.0.3","1.0.4","1.0.5"]}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@notrainer/nobtrainer-sdk"},{"type":"WEB","url":"https://wormsign.io/portfolio/@notrainer/nobtrainer-sdk/"}],"credits":[{"name":"wormsign","type":"FINDER","contact":["https://x.com/w0rmsign"]}],"database_specific":{"iocs":{"urls":["https://discord.com/api/webhooks/1433690093175967776/"]}}}