registry / Malware / litecore-lib-ltc / 1.9.6

litecore-lib-ltc@1.9.6

Litecoin utility functions for transaction creation, signing, and broadcasting.

OpenSSF/OSV Malicious Advisory

imported 3d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-18442 confirms this npm version as malicious.

Advisory

MAL-2026-18442

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in litecore-lib-ltc (npm)

Details

Malicious package. `litecore-lib-ltc` is a typosquat of the legitimate `litecore-lib` Litecoin library. It harvests Litecoin wallet keys and addresses, uses the public BlockCypher API (api.blockcypher.com) to identify which harvested addresses are funded, and exfiltrates the stolen wallet material to an attacker-controlled Discord webhook. Classification: cryptocurrency-wallet information stealer. The package provides no legitimate functionality distinct from this theft, so all published versions are malicious. Full indicators (including the complete webhook URL) are published at the reference below.

References

OpenSSF/OSV advisory PACKAGE WEB

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

The package does not appear to steal keys over the network or act automatically, but its transaction method prints the private key to stdout. This creates a material key exposure risk, so the release should be downgraded to a warning.

Static reason

No blocking static signals were detected.

Trigger

A caller invokes LitecoinWallet.send(), including through sendMax().

Impact

Logs or captured stdout may expose a key that controls the wallet’s funds.

Mechanism

The method writes this.privateKey.toString() to console before transaction construction and broadcast.

AI rationale

Evidence

src/index.js

Network endpoints2

api.blockcypher.comapi.coingecko.com

Independent scan evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Unknown with medium false-positive risk.

Evidence for AI warning decision

Calling LitecoinWallet.send() logs the wallet’s private key to stdout before validating the destination or sending a transaction.
The package has no install lifecycle hook; its entry point is src/index.js.

Evidence against

The network requests support the wallet’s stated Litecoin balance, fee, and transaction broadcasting functions.
The key logging occurs when send() is called, not automatically on import.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.97 KB of source, external domains: api.blockcypher.com, api.coingecko.com

Source & flagged code

2 flagged

src/index.jsView file

29async send(toAddress, amountSatoshis, feeSatoshis) { console.log(this.privateKey.toString()); if (!isValidAddress(toAddress)) { throw new Error(`Invalid Litecoin address: ${toAddress}`); } const utxos = await get

High

Ai Review Evidence

Calling LitecoinWallet.send() logs the wallet’s private key to stdout before validating the destination or sending a transaction.

src/index.jsView on unpkg · L29

package.jsonView file

2"name": "litecore-lib-ltc", "version": "1.9.6", "main": "src/index.js", "scripts": { "test": "echo \"Error: no test specified\" && ex

High

Suspicious Lifecycle Evidence

The package has no install lifecycle hook; its entry point is src/index.js.

package.jsonView on unpkg · L2

Findings

2 High1 Medium2 Low

HighAi Review Evidencesrc/index.js

HighSuspicious Lifecycle Evidencepackage.json

MediumNetwork

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to litecore-lib-ltc@1.9.6.

See all versions of litecore-lib-ltc for other recorded verdicts.

Avoid installing litecore-lib-ltc@1.9.6. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-11-02 06:36:40.697Z (UTC).

Source advisory published: 2026-10-29 00:00:00.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Malware / litecore-lib-ltc / 1.9.6

litecore-lib-ltc@1.9.6

Litecoin utility functions for transaction creation, signing, and broadcasting.

OpenSSF/OSV Malicious Advisory

imported 3d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-18442 confirms this npm version as malicious.

Advisory

MAL-2026-18442

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in litecore-lib-ltc (npm)

Details

References

OpenSSF/OSV advisory PACKAGE WEB

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

Static reason

No blocking static signals were detected.

Trigger

A caller invokes LitecoinWallet.send(), including through sendMax().

Impact

Logs or captured stdout may expose a key that controls the wallet’s funds.

Mechanism

The method writes this.privateKey.toString() to console before transaction construction and broadcast.

AI rationale

Evidence

src/index.js

Network endpoints2

api.blockcypher.comapi.coingecko.com

Independent scan evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Unknown with medium false-positive risk.

Evidence for AI warning decision

Calling LitecoinWallet.send() logs the wallet’s private key to stdout before validating the destination or sending a transaction.
The package has no install lifecycle hook; its entry point is src/index.js.

Evidence against

The network requests support the wallet’s stated Litecoin balance, fee, and transaction broadcasting functions.
The key logging occurs when send() is called, not automatically on import.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.97 KB of source, external domains: api.blockcypher.com, api.coingecko.com

Source & flagged code

2 flagged

src/index.jsView file

High

Ai Review Evidence

Calling LitecoinWallet.send() logs the wallet’s private key to stdout before validating the destination or sending a transaction.

src/index.jsView on unpkg · L29

package.jsonView file

2"name": "litecore-lib-ltc", "version": "1.9.6", "main": "src/index.js", "scripts": { "test": "echo \"Error: no test specified\" && ex

High

Suspicious Lifecycle Evidence

The package has no install lifecycle hook; its entry point is src/index.js.

package.jsonView on unpkg · L2

Findings

2 High1 Medium2 Low

HighAi Review Evidencesrc/index.js

HighSuspicious Lifecycle Evidencepackage.json

MediumNetwork

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to litecore-lib-ltc@1.9.6.

See all versions of litecore-lib-ltc for other recorded verdicts.

Avoid installing litecore-lib-ltc@1.9.6. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-11-02 06:36:40.697Z (UTC).

Source advisory published: 2026-10-29 00:00:00.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Findings

Affected versions and remediation

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Related packages

Other malware packages