MAL-2026-18444: Malicious code in @johnruff215-dev/solana-wallet-tracker (npm)

Published Oct 29, 2026

Updated

Malicious package. @johnruff215-dev/solana-wallet-tracker is an npm Solana cryptocurrency-wallet information stealer that exfiltrates wallet data to an attacker-controlled Discord webhook. The same Discord webhook endpoint (ID 1433690093175967776) is also used by the npm package @notrainer/nobtrainer-sdk, indicating both belong to a single actor/campaign. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicators are published at the reference below.

Affected Software

1 affected component

npm/@johnruff215-dev/solana-wallet-tracker*

Event History

Oct 29, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Frequently Asked Questions

Who is exposed to this package?

Any environment where @johnruff215-dev/solana-wallet-tracker was installed or executed is potentially exposed, particularly systems containing Solana wallet data. The package is an information stealer and has no legitimate functionality.

What data is sent to the attacker?

The package exfiltrates wallet data to an attacker-controlled Discord webhook. The webhook endpoint identified in the report has ID 1433690093175967776.

Are any versions safe to use?

No. All published versions are malicious.

What should be done if this package is present?

Remove the package from dependencies and investigate affected environments for exposed wallet data. Treat wallet information available to an environment where the package executed as potentially compromised.

Is this linked to any other package activity?

Yes. The same Discord webhook endpoint is used by @notrainer/nobtrainer-sdk, indicating the packages are associated with a single actor or campaign.

MAL-2026-18444: Malicious code in @johnruff215-dev/solana-wallet-tracker (npm)

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this package?

What data is sent to the attacker?

Are any versions safe to use?

What should be done if this package is present?

Is this linked to any other package activity?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this package?

What data is sent to the attacker?

Are any versions safe to use?

What should be done if this package is present?

Is this linked to any other package activity?