{"id":"MAL-2026-18442","summary":"Malicious code in litecore-lib-ltc (npm)","details":"Malicious package. `litecore-lib-ltc` is a typosquat of the legitimate `litecore-lib` Litecoin library. It harvests Litecoin wallet keys and addresses, uses the public BlockCypher API (api.blockcypher.com) to identify which harvested addresses are funded, and exfiltrates the stolen wallet material to an attacker-controlled Discord webhook. Classification: cryptocurrency-wallet information stealer. The package provides no legitimate functionality distinct from this theft, so all published versions are malicious. Full indicators (including the complete webhook URL) are published at the reference below.","modified":"2026-11-02T04:30:04.693297533Z","published":"2026-10-29T00:00:00Z","database_specific":{"iocs":{"urls":["https://discord.com/api/webhooks/1477797533999956131/"]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/litecore-lib-ltc"},{"type":"WEB","url":"https://wormsign.io/portfolio/litecore-lib-ltc/"}],"affected":[{"package":{"name":"litecore-lib-ltc","ecosystem":"npm","purl":"pkg:npm/litecore-lib-ltc"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.0","1.9.3","1.9.4","1.9.5","1.9.6","1.9.7","1.9.8","1.9.9","1.9.10","1.9.11","1.9.12","1.9.13","1.9.14"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/litecore-lib-ltc/MAL-2026-18442.json"}}],"schema_version":"1.9.2","credits":[{"name":"wormsign","contact":["https://x.com/w0rmsign"],"type":"FINDER"}]}