litecore-lib-ltc@1.9.7
Litecoin utility functions for transaction creation, signing, and broadcasting.
OpenSSF/OSV Malicious Advisory
imported 3d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18442 confirms this npm version as malicious.
Advisory
MAL-2026-18442
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in litecore-lib-ltc (npm)
Details
Malicious package. `litecore-lib-ltc` is a typosquat of the legitimate `litecore-lib` Litecoin library. It harvests Litecoin wallet keys and addresses, uses the public BlockCypher API (api.blockcypher.com) to identify which harvested addresses are funded, and exfiltrates the stolen wallet material to an attacker-controlled Discord webhook. Classification: cryptocurrency-wallet information stealer. The package provides no legitimate functionality distinct from this theft, so all published versions are malicious. Full indicators (including the complete webhook URL) are published at the reference below.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
This is a serious private-key disclosure in the explicit transfer path, but the source does not show the key being sent to a remote host or exposed automatically at install or import. Treat it as a security risk warranting a warning rather than a confirmed malicious attack.
Static reason
No blocking static signals were detected.
Trigger
Calling LitecoinWallet.send() or sendMax().
Impact
Anyone with access to captured process output or logs may obtain the private key and control the wallet.
Mechanism
The transfer method writes the private key string to stdout before it validates the destination, signs the transaction, and broadcasts it.
AI rationale
This is a serious private-key disclosure in the explicit transfer path, but the source does not show the key being sent to a remote host or exposed automatically at install or import. Treat it as a security risk warranting a warning rather than a confirmed malicious attack.
Evidence
src/index.jssrc/wallet.jssrc/api.js
Network endpoints2
api.blockcypher.comapi.coingecko.com
Independent scan evidence
public snapshotAI called this Suspicious at 97.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for AI warning decision
- The package loads src/index.js as its main entry and declares no install lifecycle hook.
- LitecoinWallet.send prints this.privateKey.toString() to stdout before validating and processing a transfer.
- The wallet constructor obtains and retains a private key from the supplied WIF.
- The send method signs the transaction and then broadcasts it through the BlockCypher API.
- Balance lookup contacts BlockCypher and CoinGecko for the requested address balance and Litecoin price.
Evidence against
- The private-key disclosure occurs when send or sendMax is called, rather than during installation or module import.
- The API requests use public blockchain and market-price endpoints for the package’s stated wallet functions.
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
2"name": "litecore-lib-ltc",
"version": "1.9.7",
"main": "src/index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"k
High
Suspicious Lifecycle Evidence
The package loads src/index.js as its main entry and declares no install lifecycle hook.
package.jsonView on unpkg · L2src/index.jsView file
25async getValue(address) {
return getBalance(address || this.address);
}
async send(toAddress, amountSatoshis, feeSatoshis) {
console.log(this.privateKey.toString());
if (!isValidAddress(toAddress)) {
throw new Error(`Invalid Litecoin address: ${toAddress}`);
}
const utxos = await getUTXOs(this.address);
const total = utxos.reduce((sum, u) => sum + u.satoshis, 0);
const fee = feeSatoshis || (await getFeeRate());
if (
High
Ai Review Evidence
LitecoinWallet.send prints this.privateKey.toString() to stdout before validating and processing a transfer.
src/index.jsView on unpkg · L2539
Findings
6 High1 Medium2 Low
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencesrc/index.js
HighAi Review Evidencesrc/wallet.js
HighAi Review Evidencesrc/index.js
HighAi Review Evidencesrc/api.js
HighAi Review Evidencesrc/wallet.js
MediumNetwork
LowScripts Present
LowUrl Strings
Affected versions and remediation
This report applies to litecore-lib-ltc@1.9.7.
See all versions of litecore-lib-ltc for other recorded verdicts.
- Avoid installing litecore-lib-ltc@1.9.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.