MAL-2026-18444

    Dashboard / Malicious Package / MAL-2026-18444

    MAL-2026-18444

    Published: 29 Oct 2026Last Modified: 2 Nov 2026

    Summary: Malicious code in @johnruff215-dev/solana-wallet-tracker (npm)

    Details: Malicious package. `@johnruff215-dev/solana-wallet-tracker` is an npm Solana cryptocurrency-wallet information stealer that exfiltrates wallet data to an attacker-controlled Discord webhook. The same Discord webhook endpoint (ID 1433690093175967776) is also used by the npm package `@notrainer/nobtrainer-sdk`, indicating both belong to a single actor/campaign. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicators are published at the reference below.

    References: https://www.npmjs.com/package/@johnruff215-dev/solana-wallet-tracker, https://wormsign.io/portfolio/@johnruff215-dev/solana-wallet-tracker/

    Affected packages

    Package

    Name: @johnruff215-dev/solana-wallet-tracker

    Purl: pkg:npm/%40johnruff215-dev%2Fsolana-wallet-tracker

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1.0.0
    1.0.1