GCVE-110-OSM-2026-14400

Malicious package. `@johnruff215-dev/solana-wallet-tracker` is an npm Solana cryptocurrency-wallet information stealer that exfiltrates wallet data to an attacker-controlled Discord webhook. The same Discord webhook endpoint (ID 1433690093175967776) is also used by the npm package `@notrainer/nobtrainer-sdk`, indicating both belong to a single actor/campaign. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicators are published at the reference below. ENTRY dist/index.js (main: dist/index.js) DESTINATION - 1 exfil (discord-webhook) (values recorded in verified_iocs) EXFIL - Webhook Data Exfiltration in dist/index.js: "discord.com/api/webhooks/1433690093175967776/M-6XGbPIpmhkkleZgRqn0CJH4Icm_71Gvi-..." - Webhook Data Exfiltration in src/index.ts: "discord.com/api/webhooks/1433690093175967776/M-6XGbPIpmhkkleZgRqn0CJH4Icm_71Gvi-..." - Network Request in src/index.ts: "axios.post(" ADDITIONAL FINDINGS - Chai-Max Wallet Theft Indicators in package.json: "solana-wallet" - Rapid Version Publishing PAYLOAD FILES src/index.ts (+ dist/index.js)