MAL-2026-18446

    Dashboard / Malicious Package / MAL-2026-18446

    MAL-2026-18446

    Published: 29 Oct 2026Last Modified: 2 Nov 2026

    Summary: Malicious code in @notrainer/nobtrainer-sdk (npm)

    Details: Malicious package. `@notrainer/nobtrainer-sdk` is an npm package that exfiltrates sensitive data on the victim host to an attacker-controlled Discord webhook. The same Discord webhook endpoint (ID 1433690093175967776) is also used by the npm package `@johnruff215-dev/solana-wallet-tracker`, indicating both belong to a single actor/campaign. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicators are published at the reference below.

    References: https://www.npmjs.com/package/@notrainer/nobtrainer-sdk, https://wormsign.io/portfolio/@notrainer/nobtrainer-sdk/

    Affected packages

    Package

    Name: @notrainer/nobtrainer-sdk

    Purl: pkg:npm/%40notrainer%2Fnobtrainer-sdk

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1.0.2
    1.0.3
    1.0.4
    1.0.5