wallet-tracking (PyPI) · Malicious Code
Affects wallet-trackingSource GCVE Database
Malicious package : remove wallet-tracking and rotate any secrets on hosts that installed it.
Data as of 4 Nov 2026, 00:45 UTC
Malicious package
Published to PyPI · OSV MAL-2026-18443
What to do
Remove wallet-tracking from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
PyPIwallet-trackingpkg:pypi/wallet-trackingOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The PyPI package 'wallet-tracking' is a malicious cryptocurrency wallet information stealer that collects wallet data from victim hosts and exfiltrates it to an attacker-controlled Discord webhook. It contains no legitimate functionality and all published versions are malicious. The package has been used as a dependency in a GitHub project to steal users' private keys. The source code includes an unconfigured placeholder webhook URL, indicating it is based on a copy-paste stealer template.