@notrainer/nobtrainer-sdk

GHSA-8cq9-2c2q-58ww

Malicious code in @notrainer/nobtrainer-sdk (npm)

Details

**Severity:** Critical

**Affected versions:** `> 0`

Malicious package. `@notrainer/nobtrainer-sdk` is an npm package that exfiltrates sensitive data on the victim host to an attacker-controlled Discord webhook. The same Discord webhook endpoint (ID 1433690093175967776) is also used by the npm package `@johnruff215-dev/solana-wallet-tracker`, indicating both belong to a single actor/campaign. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicators are published at the reference below.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/fb9c4145c8aa6387c0e41e8db8b54b1a839905a5/osv/malicious/npm/@notrainer/nobtrainer-sdk/MAL-2026-18446.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/fb9c4145c8aa6387c0e41e8db8b54b1a839905a5/osv/malicious/npm/@notrainer/nobtrainer-sdk/MAL-2026-18446.json
- https://wormsign.io/portfolio/@notrainer/nobtrainer-sdk
- https://www.npmjs.com/package/@notrainer/nobtrainer-sdk
- https://github.com/advisories/GHSA-8cq9-2c2q-58ww

Compromised versions (1)

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.