MAL-2026-18444

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@johnruff215-dev/solana-wallet-tracker/MAL-2026-18444.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-18444

Published

2026-10-29T00:00:00Z

Modified

2026-11-02T05:00:05Z

Summary

Malicious code in @johnruff215-dev/solana-wallet-tracker (npm)

Details

Malicious package. @johnruff215-dev/solana-wallet-tracker is an npm Solana cryptocurrency-wallet information stealer that exfiltrates wallet data to an attacker-controlled Discord webhook. The same Discord webhook endpoint (ID 1433690093175967776) is also used by the npm package @notrainer/nobtrainer-sdk, indicating both belong to a single actor/campaign. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicators are published at the reference below.

Database specific

{
    "iocs":  {
        "urls":  [
            "https://discord.com/api/webhooks/1433690093175967776/"
        ]
    }
}

References

Credits

- wormsign - FINDER
- - https://x.com/w0rmsign

Affected packages

npm / @johnruff215-dev/solana-wallet-tracker

Package

Name: @johnruff215-dev/solana-wallet-tracker; View open source insights on deps.dev
Purl: pkg:npm/%40johnruff215-dev%2Fsolana-wallet-tracker

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.0

1.0.1

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@johnruff215-dev/solana-wallet-tracker/MAL-2026-18444.json"