wallet-tracking

Details

`wallet-tracking` is a PyPI cryptocurrency-wallet information stealer. Its `track_private_key_import()` function takes a private key supplied by the caller and POSTs it in a Discord embed to a hardcoded webhook, with no redaction unless the caller passes `include_private_key=False`. The package itself reads no files or environment variables, and its only network call is a POST to the publisher's Discord webhook, which rotates between releases. Only 1.0.3 through 1.0.6 contain the stealer; 1.0.0 and 1.0.1 ship no package module.

---
_-= Per source details. Do not edit below this line.=-_

## Source: kam193 (c8740417a04191ae16526d2407f2e97a145d9a34bac6d522317be2f49b328f8e)
Package is prepared to send notifications with sensitive data. Update 2026-11-03: reclassified as malicious. The package is used as a dependency in a GitHub project to exfiltrate users' private keys https://github.com/miracle709/solana-copytrading-telegram-bot/blob/775b731d39abe5655379a5d27b0786c3952d014f/handlers/telegram_handlers.py#L543


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2025-11-wallet-tracking


Reasons (based on the campaign):


 - crypto-related


 - exfiltration-crypto


 - The malicious code is intentionally included in a dependency of the package

Compromised versions (4)

• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.