registry / Malware / litecore-lib-ltc / 1.0.0

litecore-lib-ltc@1.0.0

Litecoin utility functions for transaction creation, signing, and broadcasting.

OpenSSF/OSV Malicious Advisory

imported 3d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-18442 confirms this npm version as malicious.

Advisory

MAL-2026-18442

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in litecore-lib-ltc (npm)

Details

Malicious package. `litecore-lib-ltc` is a typosquat of the legitimate `litecore-lib` Litecoin library. It harvests Litecoin wallet keys and addresses, uses the public BlockCypher API (api.blockcypher.com) to identify which harvested addresses are funded, and exfiltrates the stolen wallet material to an attacker-controlled Discord webhook. Classification: cryptocurrency-wallet information stealer. The package provides no legitimate functionality distinct from this theft, so all published versions are malicious. Full indicators (including the complete webhook URL) are published at the reference below.

References

OpenSSF/OSV advisory PACKAGE WEB

Independent LPM AI assessment

Clean

Independent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.

The package has no install hook or automatic transfer behavior. Its network calls support its stated purpose: it uses the caller-provided key to sign a requested Litecoin transaction locally and broadcasts the signed transaction through BlockCypher.

Static reason

No blocking static signals were detected.

Trigger

A caller explicitly invokes sendLitecoin with a private key, recipient and amount.

Impact

Broadcasts the caller-requested Litecoin transaction; the source does not show the WIF being sent to the endpoint.

Mechanism

The function derives the sender address, fetches its UTXOs from api.blockcypher.com, signs a transaction locally and submits the signed transaction to that host.

AI rationale

Network endpoints1

api.blockcypher.com

Independent scan evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest points to src/index.js and declares no install lifecycle hooks; its only script is a placeholder test command.
The package exports sendLitecoin(wif, toAddress, amountSatoshis, feeSatoshis), which uses the supplied WIF to build and sign a transaction when called.
That function fetches UTXOs for the derived Litecoin address and posts the signed transaction to api.blockcypher.com for broadcast.

Evidence against

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.60 KB of source, external domains: api.blockcypher.com

Source & flagged code

4 flagged

package.jsonView file

1{ "name": "litecore-lib-ltc", "version": "1.0.0", "main": "src/index.js", "scripts": { "test": "echo \"Error: no test specified\" && exit 1" }, "keywords": ["litecoin", "crypto", "blockchain"], "license

High

Suspicious Lifecycle Evidence

The manifest points to src/index.js and declares no install lifecycle hooks; its only script is a placeholder test command.

package.jsonView on unpkg · L1

src/index.jsView file

15his - Fee in litoshis */ async function sendLitecoin(wif, toAddress, amountSatoshis, feeSatoshis = 10000) { const keyPair = ECPair.fromWIF(wif, LITECOIN); const { address: fromAddress } = bitcoin.payments.p2pkh(

High

Ai Review Evidence

The package exports sendLitecoin(wif, toAddress, amountSatoshis, feeSatoshis), which uses the supplied WIF to build and sign a transaction when called.

src/index.jsView on unpkg · L15

22// 1. Fetch UTXOs (using Blockcypher as example) const utxoRes = await axios.get( `https://api.blockcypher.com/v1/ltc/main/addrs/${fromAddress}?unspentOnly=true` ); const utxos = utxoRes.data.txrefs || [];

Findings

4 High1 Medium2 Low

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencesrc/index.js

MediumNetwork

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to litecore-lib-ltc@1.0.0.

See all versions of litecore-lib-ltc for other recorded verdicts.

Avoid installing litecore-lib-ltc@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-11-02 06:37:41.547Z (UTC).

Source advisory published: 2026-10-29 00:00:00.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Malware / litecore-lib-ltc / 1.0.0

litecore-lib-ltc@1.0.0

Litecoin utility functions for transaction creation, signing, and broadcasting.

OpenSSF/OSV Malicious Advisory

imported 3d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-18442 confirms this npm version as malicious.

Advisory

MAL-2026-18442

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in litecore-lib-ltc (npm)

Details

References

OpenSSF/OSV advisory PACKAGE WEB

Independent LPM AI assessment

Clean

Independent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.

Static reason

No blocking static signals were detected.

Trigger

A caller explicitly invokes sendLitecoin with a private key, recipient and amount.

Impact

Broadcasts the caller-requested Litecoin transaction; the source does not show the WIF being sent to the endpoint.

Mechanism

The function derives the sender address, fetches its UTXOs from api.blockcypher.com, signs a transaction locally and submits the signed transaction to that host.

AI rationale

Network endpoints1

api.blockcypher.com

Independent scan evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest points to src/index.js and declares no install lifecycle hooks; its only script is a placeholder test command.
The package exports sendLitecoin(wif, toAddress, amountSatoshis, feeSatoshis), which uses the supplied WIF to build and sign a transaction when called.
That function fetches UTXOs for the derived Litecoin address and posts the signed transaction to api.blockcypher.com for broadcast.

Evidence against

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.60 KB of source, external domains: api.blockcypher.com

Source & flagged code

4 flagged

package.jsonView file

High

Suspicious Lifecycle Evidence

The manifest points to src/index.js and declares no install lifecycle hooks; its only script is a placeholder test command.

package.jsonView on unpkg · L1

src/index.jsView file

High

Ai Review Evidence

The package exports sendLitecoin(wif, toAddress, amountSatoshis, feeSatoshis), which uses the supplied WIF to build and sign a transaction when called.

src/index.jsView on unpkg · L15

Findings

4 High1 Medium2 Low

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencesrc/index.js

MediumNetwork

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to litecore-lib-ltc@1.0.0.

See all versions of litecore-lib-ltc for other recorded verdicts.

Avoid installing litecore-lib-ltc@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-11-02 06:37:41.547Z (UTC).

Source advisory published: 2026-10-29 00:00:00.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Findings

Affected versions and remediation

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Related packages

Other malware packages