wallet-tracking

GHSA-8wmf-9cp5-g5hq

Malicious code in wallet-tracking (PyPI)

Details

**Severity:** Critical

**Affected versions:** `> 0`

Malicious package. `wallet-tracking` is a PyPI cryptocurrency-wallet information stealer. It collects wallet data on the victim host and exfiltrates it to an attacker-controlled Discord webhook. The source also still contains an unconfigured placeholder webhook URL (.../api/webhooks/YOUR_URL) beside the live one, indicating a copy-paste stealer template. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. First observed by wormsign on 2026-05-30. Full indicators are published at the reference below.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/f63470f52b3707cb0ecb4ced35a983237466e281/osv/malicious/pypi/wallet-tracking/MAL-2026-18443.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/f63470f52b3707cb0ecb4ced35a983237466e281/osv/malicious/pypi/wallet-tracking/MAL-2026-18443.json
- https://pypi.org/project/wallet-tracking
- https://wormsign.io/portfolio/wallet-tracking
- https://bad-packages.kam193.eu/pypi/package/wallet-tracking
- https://github.com/miracle709/solana-copytrading-telegram-bot
- https://github.com/ossf/malicious-packages/blob/1e4237ca98763ed2d8211b2da89735a05116385b/osv/malicious/pypi/wallet-tracking/MAL-2026-18443.json
- https://github.com/ossf/malicious-packages/blob/38e4196ca4669b316bb4fccd4e069014328bec51/osv/malicious/pypi/wallet-tracking/MAL-2026-18443.json
- https://github.com/advisories/GHSA-8wmf-9cp5-g5hq

Compromised versions (1)

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.