---
id: MAL-2026-18443
title: Malicious code in wallet-tracking (PyPI)
summary: Malicious code in wallet-tracking (PyPI)
severity: critical
exploited: true
vendor: wallet-tracking
product: wallet-tracking
ecosystem: pip
affected:
  - wallet-tracking >= 1.0.3
published: '2025-11-16'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T04:45:03.147857059Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/MAL-2026-18443'
references:
  - url: 'https://pypi.org/project/wallet-tracking/'
  - url: 'https://wormsign.io/portfolio/wallet-tracking/'
  - url: 'https://github.com/miracle709/solana-copytrading-telegram-bot'
  - url: 'https://bad-packages.kam193.eu/pypi/package/wallet-tracking'
tags:
  - osv
  - pip
  - malware
ingestedAt: '2026-11-02T19:08:05.712Z'
---

## Overview

`wallet-tracking` is a PyPI cryptocurrency-wallet information stealer. Its `track_private_key_import()` function takes a private key supplied by the caller and POSTs it in a Discord embed to a hardcoded webhook, with no redaction unless the caller passes `include_private_key=False`. The package itself reads no files or environment variables, and its only network call is a POST to the publisher's Discord webhook, which rotates between releases. Only 1.0.3 through 1.0.6 contain the stealer; 1.0.0 and 1.0.1 ship no package module.

---
_-= Per source details. Do not edit below this line.=-_

## Source: kam193 (c8740417a04191ae16526d2407f2e97a145d9a34bac6d522317be2f49b328f8e)
Package is prepared to send notifications with sensitive data. Update 2026-11-03: reclassified as malicious. The package is used as a dependency in a GitHub project to exfiltrate users' private keys https://github.com/miracle709/solana-copytrading-telegram-bot/blob/775b731d39abe5655379a5d27b0786c3952d014f/handlers/telegram_handlers.py#L543


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2025-11-wallet-tracking


Reasons (based on the campaign):


 - crypto-related


 - exfiltration-crypto


 - The malicious code is intentionally included in a dependency of the package


## Affected packages

- `wallet-tracking >= 1.0.3`

## Remediation

Refer to the advisory for the patched release.