The PyPI package 'wallet-tracking' is a malicious cryptocurrency wallet information stealer that collects wallet data from victim hosts and exfiltrates it to an attacker-controlled Discord webhook. It contains no legitimate functionality and all published versions are malicious. The package has been used as a dependency in a GitHub project to steal users' private keys. The source code includes an unconfigured placeholder webhook URL, indicating it is based on a copy-paste stealer template.