litecore-lib-ltc

Details

**Severity:** Critical

**Affected versions:** `> 0`

Malicious package. `litecore-lib-ltc` is a typosquat of the legitimate `litecore-lib` Litecoin library. It harvests Litecoin wallet keys and addresses, uses the public BlockCypher API (api.blockcypher.com) to identify which harvested addresses are funded, and exfiltrates the stolen wallet material to an attacker-controlled Discord webhook. Classification: cryptocurrency-wallet information stealer. The package provides no legitimate functionality distinct from this theft, so all published versions are malicious. Full indicators (including the complete webhook URL) are published at the reference below.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/92f4861bbd643ecbcd781e15145b7207b465a8c2/osv/malicious/npm/litecore-lib-ltc/MAL-2026-18442.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/92f4861bbd643ecbcd781e15145b7207b465a8c2/osv/malicious/npm/litecore-lib-ltc/MAL-2026-18442.json
- https://wormsign.io/portfolio/litecore-lib-ltc
- https://www.npmjs.com/package/litecore-lib-ltc
- https://github.com/advisories/GHSA-9jxw-2pvm-5q9f

Compromised versions (1)

• > 0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.