If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
`wallet-tracking` is a PyPI cryptocurrency-wallet information stealer. Its `track_private_key_import()` function takes a private key supplied by the caller and POSTs it in a Discord embed to a hardcoded webhook, with no redaction unless the caller passes `include_private_key=False`. The package itself reads no files or environment variables, and its only network call is a POST to the publisher's Discord webhook, which rotates between releases. Only 1.0.3 through 1.0.6 contain the stealer; 1.0.0 and 1.0.1 ship no package module.
---
_-= Per source details. Do not edit below this line.=-_
Source: kam193 (c8740417a04191ae16526d2407f2e97a145d9a34bac6d522317be2f49b328f8e)
Package is prepared to send notifications with sensitive data. Update 2026-11-03: reclassified as malicious. The package is used as a dependency in a GitHub project to exfiltrate users' private keys https://github.com/miracle709/solana-copytrading-telegram-bot/blob/775b731d39abe5655379a5d27b0786c3952d014f/handlers/telegram_handlers.py#L543
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-11-wallet-tracking
Reasons (based on the campaign):
- crypto-related
- exfiltration-crypto
- The malicious code is intentionally included in a dependency of the package
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://discord[.]com/api/webhooks/1433690093175967776/ other packages →
- hxxps://discord[.]com/api/webhooks/1442249211453378662/ other packages →
- hxxps://discordapp[.]com/api/webhooks/1442389288108036187/ other packages →