GCVE-110-OSM-2026-14406

Malicious package. `wallet-tracking` is a PyPI cryptocurrency-wallet information stealer. It collects wallet data on the victim host and exfiltrates it to an attacker-controlled Discord webhook. The source also still contains an unconfigured placeholder webhook URL (.../api/webhooks/YOUR_URL) beside the live one, indicating a copy-paste stealer template. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. First observed by wormsign on 2026-05-30. Full indicators are published at the reference below. DESTINATION - 2 exfil (discord-webhook, custom-c2) (values recorded in verified_iocs) EXFIL - Webhook Data Exfiltration in wallet_tracking/tracker.py: "discordapp.com/api/webhooks/1442389288108036187/yBdBaE59OSpvl5YUjlelb4R7VvY2wZk6..." - Network Request in wallet_tracking/tracker.py: "requests.post(" PAYLOAD FILES wallet_tracking/tracker.py