MAL-2026-18443Critical▾ Abyssal⚠ Exploited in the wildMalicious code in wallet-tracking (PyPI)
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 52.3 · likelihood 0 · exploitation 18
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
wallet-tracking is a PyPI cryptocurrency-wallet information stealer. Its track_private_key_import() function takes a private key supplied by the caller and POSTs it in a Discord embed to a hardcoded webhook, with no redaction unless the caller passes include_private_key=False. The package itself reads no files or environment variables, and its only network call is a POST to the publisher's Discord webhook, which rotates between releases. Only 1.0.3 through 1.0.6 contain the stealer; 1.0.0 and 1.0.1 ship no package module.
-= Per source details. Do not edit below this line.=-
Package is prepared to send notifications with sensitive data. Update 2026-11-03: reclassified as malicious. The package is used as a dependency in a GitHub project to exfiltrate users' private keys https://github.com/miracle709/solana-copytrading-telegram-bot/blob/775b731d39abe5655379a5d27b0786c3952d014f/handlers/telegram_handlers.py#L543
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2025-11-wallet-tracking
Reasons (based on the campaign):
crypto-related
exfiltration-crypto
The malicious code is intentionally included in a dependency of the package
wallet-tracking >= 1.0.3Refer to the advisory for the patched release.