MAL-2026-18443

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/wallet-tracking/MAL-2026-18443.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-18443

Published

2026-10-29T00:00:00Z

Modified

2026-11-02T04:45:03Z

Summary

Malicious code in wallet-tracking (PyPI)

Details

Malicious package. wallet-tracking is a PyPI cryptocurrency-wallet information stealer. It collects wallet data on the victim host and exfiltrates it to an attacker-controlled Discord webhook. The source also still contains an unconfigured placeholder webhook URL (.../api/webhooks/YOUR_URL) beside the live one, indicating a copy-paste stealer template. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. First observed by wormsign on 2026-05-30. Full indicators are published at the reference below.

Database specific

{
    "iocs":  {
        "urls":  [
            "https://discordapp.com/api/webhooks/1442389288108036187/"
        ]
    }
}

References

Credits

- wormsign - FINDER
- - https://x.com/w0rmsign

Affected packages

PyPI / wallet-tracking

Package

Name: wallet-tracking; View open source insights on deps.dev
Purl: pkg:pypi/wallet-tracking

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.0

1.0.1

1.0.3

1.0.4

1.0.5

1.0.6

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/wallet-tracking/MAL-2026-18443.json"