MAL-2026-18446

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@notrainer/nobtrainer-sdk/MAL-2026-18446.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-18446

Published

2026-10-29T00:00:00Z

Modified

2026-11-02T05:15:06Z

Summary

Malicious code in @notrainer/nobtrainer-sdk (npm)

Details

Malicious package. @notrainer/nobtrainer-sdk is an npm package that exfiltrates sensitive data on the victim host to an attacker-controlled Discord webhook. The same Discord webhook endpoint (ID 1433690093175967776) is also used by the npm package @johnruff215-dev/solana-wallet-tracker, indicating both belong to a single actor/campaign. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicators are published at the reference below.

Database specific

{
    "iocs":  {
        "urls":  [
            "https://discord.com/api/webhooks/1433690093175967776/"
        ]
    }
}

References

Credits

- wormsign - FINDER
- - https://x.com/w0rmsign

Affected packages

npm / @notrainer/nobtrainer-sdk

Package

Name: @notrainer/nobtrainer-sdk; View open source insights on deps.dev
Purl: pkg:npm/%40notrainer%2Fnobtrainer-sdk

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.2

1.0.3

1.0.4

1.0.5

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@notrainer/nobtrainer-sdk/MAL-2026-18446.json"