registry / Malware / litecore-lib-ltc / 1.9.3

litecore-lib-ltc@1.9.3

Litecoin utility functions for transaction creation, signing, and broadcasting.

OpenSSF/OSV Malicious Advisory

imported 3d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-18442 confirms this npm version as malicious.

Advisory

MAL-2026-18442

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in litecore-lib-ltc (npm)

Details

Malicious package. `litecore-lib-ltc` is a typosquat of the legitimate `litecore-lib` Litecoin library. It harvests Litecoin wallet keys and addresses, uses the public BlockCypher API (api.blockcypher.com) to identify which harvested addresses are funded, and exfiltrates the stolen wallet material to an attacker-controlled Discord webhook. Classification: cryptocurrency-wallet information stealer. The package provides no legitimate functionality distinct from this theft, so all published versions are malicious. Full indicators (including the complete webhook URL) are published at the reference below.

References

OpenSSF/OSV advisory PACKAGE WEB

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

The package does not show malicious install-time or import-time behavior, but its send method prints the wallet’s private key during an ordinary transaction operation. This creates a serious local exposure risk, so the release should be warned on pending review or correction.

Static reason

No blocking static signals were detected.

Trigger

A caller invokes LitecoinWallet.send() or sendMax().

Impact

Anyone with access to captured stdout or logs may obtain the private key and spend the wallet’s funds.

Mechanism

send() converts the stored private key to a string and logs it before validating the destination or signing and broadcasting the transaction.

AI rationale

Evidence

src/index.jssrc/wallet.jssrc/api,js

Network endpoints1

api.blockcypher.com/v1/ltc/main

Independent scan evidence

public snapshot

AI called this Suspicious at 97.0% confidence as Unknown with medium false-positive risk.

Evidence for AI warning decision

Calling LitecoinWallet.send() writes this.privateKey.toString() to stdout before address validation.
The class stores a private key created from the caller-supplied WIF, and send() later uses that key to sign a transaction.
The manifest has no install lifecycle hook; network calls are part of explicit wallet operations.

Evidence against

The key is not sent to a remote host in the inspected source.
The package’s network requests use BlockCypher for Litecoin balance, UTXO, fee and transaction broadcast operations.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.95 KB of source, external domains: api.blockcypher.com, api.coingecko.com

Source & flagged code

5 flagged

src/index.jsView file

25async getValue(address) { return getBalance(address || this.address); } async send(toAddress, amountSatoshis, feeSatoshis) { console.log(this.privateKey.toString()); if (!isValidAddress(toAddress)) { throw new Error(`Invalid Litecoin addr

High

Ai Review Evidence

Calling LitecoinWallet.send() writes this.privateKey.toString() to stdout before address validation.

src/index.jsView on unpkg · L25

5class LitecoinWallet { constructor(wif) { const { privateKey, address } = fromWIF(wif); this.privateKey = privateKey; this.address = address; } static generate() { return generateWallet(); } static isValidAddress(address) { return isValidAddress(address);

High

Ai Review Evidence

The class stores a private key created from the caller-supplied WIF, and send() later uses that key to sign a transaction.

src/index.jsView on unpkg · L5

43const tx = new bitcore.Transaction() .from(utxos) .to(toAddress, amountSatoshis) .change(this.address) .fee(fee) .sign(this.privateKey); const txHex = tx.serialize(); const txHash = await broadcastTx(txHex);

High

Findings

5 High1 Medium2 Low

HighAi Review Evidencesrc/index.js

HighSuspicious Lifecycle Evidencepackage.json

HighSuspicious Lifecycle Evidencesrc/api,js

MediumNetwork

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to litecore-lib-ltc@1.9.3.

See all versions of litecore-lib-ltc for other recorded verdicts.

Avoid installing litecore-lib-ltc@1.9.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-11-02 06:37:48.162Z (UTC).

Source advisory published: 2026-10-29 00:00:00.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Malware / litecore-lib-ltc / 1.9.3

litecore-lib-ltc@1.9.3

Litecoin utility functions for transaction creation, signing, and broadcasting.

OpenSSF/OSV Malicious Advisory

imported 3d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-18442 confirms this npm version as malicious.

Advisory

MAL-2026-18442

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in litecore-lib-ltc (npm)

Details

References

OpenSSF/OSV advisory PACKAGE WEB

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

Static reason

No blocking static signals were detected.

Trigger

A caller invokes LitecoinWallet.send() or sendMax().

Impact

Anyone with access to captured stdout or logs may obtain the private key and spend the wallet’s funds.

Mechanism

send() converts the stored private key to a string and logs it before validating the destination or signing and broadcasting the transaction.

AI rationale

Evidence

src/index.jssrc/wallet.jssrc/api,js

Network endpoints1

api.blockcypher.com/v1/ltc/main

Independent scan evidence

public snapshot

AI called this Suspicious at 97.0% confidence as Unknown with medium false-positive risk.

Evidence for AI warning decision

Calling LitecoinWallet.send() writes this.privateKey.toString() to stdout before address validation.
The class stores a private key created from the caller-supplied WIF, and send() later uses that key to sign a transaction.
The manifest has no install lifecycle hook; network calls are part of explicit wallet operations.

Evidence against

The key is not sent to a remote host in the inspected source.
The package’s network requests use BlockCypher for Litecoin balance, UTXO, fee and transaction broadcast operations.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.95 KB of source, external domains: api.blockcypher.com, api.coingecko.com

Source & flagged code

5 flagged

src/index.jsView file

High

Ai Review Evidence

Calling LitecoinWallet.send() writes this.privateKey.toString() to stdout before address validation.

src/index.jsView on unpkg · L25

High

Ai Review Evidence

The class stores a private key created from the caller-supplied WIF, and send() later uses that key to sign a transaction.

src/index.jsView on unpkg · L5

High

Findings

5 High1 Medium2 Low

HighAi Review Evidencesrc/index.js

HighSuspicious Lifecycle Evidencepackage.json

HighSuspicious Lifecycle Evidencesrc/api,js

MediumNetwork

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to litecore-lib-ltc@1.9.3.

See all versions of litecore-lib-ltc for other recorded verdicts.

Avoid installing litecore-lib-ltc@1.9.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-11-02 06:37:48.162Z (UTC).

Source advisory published: 2026-10-29 00:00:00.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Findings

Affected versions and remediation

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Related packages

Other malware packages