Live › package › MAL-2026-18442
Not triaged yet. The sources’ own description is below.
First seen by InfraStack 2026-11-02 05:21 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| litecore-lib-ltc | npm | all versions | – |
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Malicious package. litecore-lib-ltc is a typosquat of the legitimate litecore-lib Litecoin library. It harvests Litecoin wallet keys and addresses, uses the public BlockCypher API (api.blockcypher.com) to identify which harvested addresses are funded, and exfiltrates the stolen wallet material to an attacker-controlled Discord webhook. Classification: cryptocurrency-wallet information stealer. The package provides no legitimate functionality distinct from this theft, so all published versions are malicious. Full indicators (including the complete webhook URL) are published at the reference below.
This page as .md · .json · in your agent: get_signal("MAL-2026-18442")