Vulnerability MAL-2026-18446

Malicious package. @notrainer/nobtrainer-sdk is an npm package that exfiltrates sensitive data on the victim host to an attacker-controlled Discord webhook. The same Discord webhook endpoint (ID 1433690093175967776) is also used by the npm package @johnruff215-dev/solana-wallet-tracker, indicating both belong to a single actor/campaign. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicators are published at the reference below.