Vulnerability MAL-2026-18444

Malicious package. @johnruff215-dev/solana-wallet-tracker is an npm Solana cryptocurrency-wallet information stealer that exfiltrates wallet data to an attacker-controlled Discord webhook. The same Discord webhook endpoint (ID 1433690093175967776) is also used by the npm package @notrainer/nobtrainer-sdk, indicating both belong to a single actor/campaign. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicators are published at the reference below.