@johnruff215-dev/solana-wallet-tracker

GHSA-w48h-24q2-rjqx

Malicious code in @johnruff215-dev/solana-wallet-tracker (npm)

Details

**Severity:** Critical

**Affected versions:** `> 0`

Malicious package. `@johnruff215-dev/solana-wallet-tracker` is an npm Solana cryptocurrency-wallet information stealer that exfiltrates wallet data to an attacker-controlled Discord webhook. The same Discord webhook endpoint (ID 1433690093175967776) is also used by the npm package `@notrainer/nobtrainer-sdk`, indicating both belong to a single actor/campaign. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicators are published at the reference below.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/b337921a81b02c069c24c0237e55afc334800d7b/osv/malicious/npm/@johnruff215-dev/solana-wallet-tracker/MAL-2026-18444.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/b337921a81b02c069c24c0237e55afc334800d7b/osv/malicious/npm/@johnruff215-dev/solana-wallet-tracker/MAL-2026-18444.json
- https://wormsign.io/portfolio/@johnruff215-dev/solana-wallet-tracker
- https://www.npmjs.com/package/@johnruff215-dev/solana-wallet-tracker
- https://github.com/advisories/GHSA-w48h-24q2-rjqx

Compromised versions (1)

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.