MAL-2026-18442

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/litecore-lib-ltc/MAL-2026-18442.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18442
Published
2026-10-29T00:00:00Z
Modified
2026-11-02T04:30:04Z
Summary
Malicious code in litecore-lib-ltc (npm)
Details

Malicious package. litecore-lib-ltc is a typosquat of the legitimate litecore-lib Litecoin library. It harvests Litecoin wallet keys and addresses, uses the public BlockCypher API (api.blockcypher.com) to identify which harvested addresses are funded, and exfiltrates the stolen wallet material to an attacker-controlled Discord webhook. Classification: cryptocurrency-wallet information stealer. The package provides no legitimate functionality distinct from this theft, so all published versions are malicious. Full indicators (including the complete webhook URL) are published at the reference below.

Database specific 
{
    "iocs":  {
        "urls":  [
            "https://discord.com/api/webhooks/1477797533999956131/"
        ]
    }
}
References
Credits

Affected packages

npm / litecore-lib-ltc

Package

Name
litecore-lib-ltc
View open source insights on deps.dev
Purl
pkg:npm/litecore-lib-ltc

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.0.0
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
1.9.8
1.9.9
1.9.10
1.9.11
1.9.12
1.9.13
1.9.14

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/litecore-lib-ltc/MAL-2026-18442.json"