registry / Malware / litecore-lib-ltc / 1.9.4

litecore-lib-ltc@1.9.4

Litecoin utility functions for transaction creation, signing, and broadcasting.

OpenSSF/OSV Malicious Advisory

imported 3d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-18442 confirms this npm version as malicious.

Advisory

MAL-2026-18442

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in litecore-lib-ltc (npm)

Details

Malicious package. `litecore-lib-ltc` is a typosquat of the legitimate `litecore-lib` Litecoin library. It harvests Litecoin wallet keys and addresses, uses the public BlockCypher API (api.blockcypher.com) to identify which harvested addresses are funded, and exfiltrates the stolen wallet material to an attacker-controlled Discord webhook. Classification: cryptocurrency-wallet information stealer. The package provides no legitimate functionality distinct from this theft, so all published versions are malicious. Full indicators (including the complete webhook URL) are published at the reference below.

References

OpenSSF/OSV advisory PACKAGE WEB

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

The package’s transaction send method prints the wallet’s private key to stdout, creating an avoidable risk of key exposure in logs. The network activity otherwise matches the wallet’s stated purpose, and no install-time or import-time attack was identified.

Static reason

No blocking static signals were detected.

Trigger

A caller invokes LitecoinWallet.send() or sendMax().

Impact

Logs or captured stdout may retain a reusable private key, enabling whoever can read them to control the wallet’s funds.

Mechanism

send() calls console.log on the private key’s string representation before proceeding with transaction validation and signing.

AI rationale

Evidence

src/index.js

Network endpoints2

api.blockcypher.comapi.coingecko.com

Independent scan evidence

public snapshot

AI called this Suspicious at 97.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for AI warning decision

Calling LitecoinWallet.send() prints the wallet’s private key to stdout before validating the destination or constructing the transaction.
The same method uses that private key to sign and broadcast the transaction, so the console output exposes a reusable wallet secret during an ordinary send operation.

Evidence against

The package has no install lifecycle hook; its manifest declares only a placeholder test script.
Network requests use BlockCypher for Litecoin UTXOs and transaction broadcast, consistent with the package’s stated wallet purpose.
The inspected entry point performs network activity through wallet methods rather than at import time.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.95 KB of source, external domains: api.blockcypher.com, api.coingecko.com

Source & flagged code

3 flagged

src/index.jsView file

30le.log(this.privateKey.toString()); if (!isValidAddress(toAddress)) { throw new Error(`Invalid Litecoin address: ${toAddress}`); } const utxos = a

High

Ai Review Evidence

Calling LitecoinWallet.send() prints the wallet’s private key to stdout before validating the destination or constructing the transaction.

src/index.jsView on unpkg · L30

43.from(utxos) .to(toAddress, amountSatoshis) .change(this.address) .fee(fee) .sign(this.privateKey); const txHex = tx.serialize(); co

High

Ai Review Evidence

The same method uses that private key to sign and broadcast the transaction, so the console output exposes a reusable wallet secret during an ordinary send operation.

src/index.jsView on unpkg · L43

src/api,jsView file

2ASE = 'https://api.blockcypher.com/v1/ltc/main'; async function getUTXOs(address) { const res = await axios.get(`${BASE}/addrs/${address}?unspentOnly=true`); return (res.data.txrefs || []).map(u => ({ txId:

Findings

3 High1 Medium2 Low

HighAi Review Evidencesrc/index.js

HighAi Review Evidencesrc/api,js

MediumNetwork

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to litecore-lib-ltc@1.9.4.

See all versions of litecore-lib-ltc for other recorded verdicts.

Avoid installing litecore-lib-ltc@1.9.4. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-11-02 06:37:03.991Z (UTC).

Source advisory published: 2026-10-29 00:00:00.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Malware / litecore-lib-ltc / 1.9.4

litecore-lib-ltc@1.9.4

Litecoin utility functions for transaction creation, signing, and broadcasting.

OpenSSF/OSV Malicious Advisory

imported 3d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-18442 confirms this npm version as malicious.

Advisory

MAL-2026-18442

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in litecore-lib-ltc (npm)

Details

References

OpenSSF/OSV advisory PACKAGE WEB

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

Static reason

No blocking static signals were detected.

Trigger

A caller invokes LitecoinWallet.send() or sendMax().

Impact

Logs or captured stdout may retain a reusable private key, enabling whoever can read them to control the wallet’s funds.

Mechanism

send() calls console.log on the private key’s string representation before proceeding with transaction validation and signing.

AI rationale

Evidence

src/index.js

Network endpoints2

api.blockcypher.comapi.coingecko.com

Independent scan evidence

public snapshot

AI called this Suspicious at 97.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for AI warning decision

Calling LitecoinWallet.send() prints the wallet’s private key to stdout before validating the destination or constructing the transaction.
The same method uses that private key to sign and broadcast the transaction, so the console output exposes a reusable wallet secret during an ordinary send operation.

Evidence against

The package has no install lifecycle hook; its manifest declares only a placeholder test script.
Network requests use BlockCypher for Litecoin UTXOs and transaction broadcast, consistent with the package’s stated wallet purpose.
The inspected entry point performs network activity through wallet methods rather than at import time.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.95 KB of source, external domains: api.blockcypher.com, api.coingecko.com

Source & flagged code

3 flagged

src/index.jsView file

30le.log(this.privateKey.toString()); if (!isValidAddress(toAddress)) { throw new Error(`Invalid Litecoin address: ${toAddress}`); } const utxos = a

High

Ai Review Evidence

Calling LitecoinWallet.send() prints the wallet’s private key to stdout before validating the destination or constructing the transaction.

src/index.jsView on unpkg · L30

43.from(utxos) .to(toAddress, amountSatoshis) .change(this.address) .fee(fee) .sign(this.privateKey); const txHex = tx.serialize(); co

High

Ai Review Evidence

The same method uses that private key to sign and broadcast the transaction, so the console output exposes a reusable wallet secret during an ordinary send operation.

src/index.jsView on unpkg · L43

src/api,jsView file

Findings

3 High1 Medium2 Low

HighAi Review Evidencesrc/index.js

HighAi Review Evidencesrc/api,js

MediumNetwork

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to litecore-lib-ltc@1.9.4.

See all versions of litecore-lib-ltc for other recorded verdicts.

Avoid installing litecore-lib-ltc@1.9.4. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-11-02 06:37:03.991Z (UTC).

Source advisory published: 2026-10-29 00:00:00.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Findings

Affected versions and remediation

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Related packages

Other malware packages