Rogue NuGet Package Poses as Tracer.Fody, Steals Cryptocurrency Wallet Data

Cybersecurity researchers uncovered a malicious NuGet package named Tracer.Fody[.]NLog that typosquats and impersonates the Tracer[.]Fody library to slip in a cryptocurrency wallet stealer, the discovery noting it has remained on NuGet since February 26, 2020 and was published by a user named “csnemess.” The package masquerades as Tracer[.]Fody, maintained by csnemes, and has been downloaded at least 2,000 times, with 19 downloads for version 3.2.4 in the past six weeks.

Inside the malicious package, the embedded Tracer.Fody.dll scans the default Stratis wallet directory on Windows, reads *.wallet.json files and in-memory passwords, and exfiltrates them to threat actor‑controlled infrastructure in Russia at 176.113.82[.]163. Defenders are warned that the attacker used tactics to evade review, including a name misspelling that mirrors csnemes vs csnemess, Cyrillic lookalike characters, and concealing the malware in a generic helper function called Guard[.]NotNull.

The findings also reference a prior December 2023 incident where a similar threat used the name Cleary[.]AsyncExtensions under stevencleary, signalling a pattern of stealthy, open‑source typosquats targeting .NET projects. According to Socket security researcher Kirill Boychenko, the malware reads wallet data and wallet passwords and exfiltrates them even if exfiltration fails, underscoring the persistence of such supply‑chain threats.