registry / Malware / litecore-lib-ltc / 1.9.5

litecore-lib-ltc@1.9.5

Litecoin utility functions for transaction creation, signing, and broadcasting.

OpenSSF/OSV Malicious Advisory

imported 3d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-18442 confirms this npm version as malicious.

Advisory

MAL-2026-18442

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in litecore-lib-ltc (npm)

Details

Malicious package. `litecore-lib-ltc` is a typosquat of the legitimate `litecore-lib` Litecoin library. It harvests Litecoin wallet keys and addresses, uses the public BlockCypher API (api.blockcypher.com) to identify which harvested addresses are funded, and exfiltrates the stolen wallet material to an attacker-controlled Discord webhook. Classification: cryptocurrency-wallet information stealer. The package provides no legitimate functionality distinct from this theft, so all published versions are malicious. Full indicators (including the complete webhook URL) are published at the reference below.

References

OpenSSF/OSV advisory PACKAGE WEB

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

The package has no install-time behavior or evident unrelated network collection, but its wallet send path unnecessarily prints the private key. That creates a serious credential exposure risk, though the reviewed source does not establish remote exfiltration.

Static reason

No blocking static signals were detected.

Trigger

A caller invokes LitecoinWallet.send() or sendMax().

Impact

Private key material may be captured by terminal logs, process supervisors, or application logging systems and used to spend the wallet's funds.

Mechanism

send() calls console.log(this.privateKey.toString()) before validating the recipient or constructing the transaction.

AI rationale

Evidence

src/index.jssrc/wallet.jssrc/api,js

Network endpoints2

api.blockcypher.comapi.coingecko.com

Independent scan evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Unknown with medium false-positive risk.

Evidence for AI warning decision

The package entry point is src/index.js, and its send method prints the wallet private key to stdout before validating the destination or building a transaction.
Wallet construction stores the private key returned from WIF parsing, so the value printed by send is secret key material.

Evidence against

The manifest has no install lifecycle scripts; its only script is a placeholder test command.
Network calls use public BlockCypher and CoinGecko APIs for Litecoin balances, fees, UTXOs, and transaction broadcasting.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.95 KB of source, external domains: api.blockcypher.com, api.coingecko.com

Source & flagged code

4 flagged

src/index.jsView file

29async send(toAddress, amountSatoshis, feeSatoshis) { console.log(this.privateKey.toString()); if (!isValidAddress(toAddress)) { throw new Error(`Invalid Litecoin address: ${toAddress}`); } const utxos = await getUTXOs(t

High

Ai Review Evidence

The package entry point is src/index.js, and its send method prints the wallet private key to stdout before validating the destination or building a transaction.

src/index.jsView on unpkg · L29

src/wallet.jsView file

3function fromWIF(wif) { const privateKey = new bitcore.PrivateKey(wif); const address = privateKey.toAddress().toString(); return { privateKey, address }; } function g

High

Ai Review Evidence

Wallet construction stores the private key returned from WIF parsing, so the value printed by send is secret key material.

src/wallet.jsView on unpkg · L3

package.jsonView file

Findings

4 High1 Medium2 Low

HighAi Review Evidencesrc/index.js

HighAi Review Evidencesrc/wallet.js

HighAi Review Evidencepackage.json

HighAi Review Evidencesrc/api,js

MediumNetwork

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to litecore-lib-ltc@1.9.5.

See all versions of litecore-lib-ltc for other recorded verdicts.

Avoid installing litecore-lib-ltc@1.9.5. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-11-02 06:36:41.065Z (UTC).

Source advisory published: 2026-10-29 00:00:00.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Malware / litecore-lib-ltc / 1.9.5

litecore-lib-ltc@1.9.5

Litecoin utility functions for transaction creation, signing, and broadcasting.

OpenSSF/OSV Malicious Advisory

imported 3d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-18442 confirms this npm version as malicious.

Advisory

MAL-2026-18442

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in litecore-lib-ltc (npm)

Details

References

OpenSSF/OSV advisory PACKAGE WEB

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

Static reason

No blocking static signals were detected.

Trigger

A caller invokes LitecoinWallet.send() or sendMax().

Impact

Private key material may be captured by terminal logs, process supervisors, or application logging systems and used to spend the wallet's funds.

Mechanism

send() calls console.log(this.privateKey.toString()) before validating the recipient or constructing the transaction.

AI rationale

Evidence

src/index.jssrc/wallet.jssrc/api,js

Network endpoints2

api.blockcypher.comapi.coingecko.com

Independent scan evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Unknown with medium false-positive risk.

Evidence for AI warning decision

The package entry point is src/index.js, and its send method prints the wallet private key to stdout before validating the destination or building a transaction.
Wallet construction stores the private key returned from WIF parsing, so the value printed by send is secret key material.

Evidence against

The manifest has no install lifecycle scripts; its only script is a placeholder test command.
Network calls use public BlockCypher and CoinGecko APIs for Litecoin balances, fees, UTXOs, and transaction broadcasting.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.95 KB of source, external domains: api.blockcypher.com, api.coingecko.com

Source & flagged code

4 flagged

src/index.jsView file

High

Ai Review Evidence

The package entry point is src/index.js, and its send method prints the wallet private key to stdout before validating the destination or building a transaction.

src/index.jsView on unpkg · L29

src/wallet.jsView file

3function fromWIF(wif) { const privateKey = new bitcore.PrivateKey(wif); const address = privateKey.toAddress().toString(); return { privateKey, address }; } function g

High

Ai Review Evidence

Wallet construction stores the private key returned from WIF parsing, so the value printed by send is secret key material.

src/wallet.jsView on unpkg · L3

package.jsonView file

Findings

4 High1 Medium2 Low

HighAi Review Evidencesrc/index.js

HighAi Review Evidencesrc/wallet.js

HighAi Review Evidencepackage.json

HighAi Review Evidencesrc/api,js

MediumNetwork

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to litecore-lib-ltc@1.9.5.

See all versions of litecore-lib-ltc for other recorded verdicts.

Avoid installing litecore-lib-ltc@1.9.5. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-11-02 06:36:41.065Z (UTC).

Source advisory published: 2026-10-29 00:00:00.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Findings

Affected versions and remediation

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Related packages

Other malware packages