---
id: "MAL-2026-18442"
kind: "package"
aliases: ["MAL-2026-18442"]
title: "Malicious code in litecore-lib-ltc (npm)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "litecore-lib-ltc", "fixed": [], "affected": "all versions", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-10-29T00:00:00+00:00"
first_seen_at: "2026-11-02T05:21:18+00:00"
updated_at: "2026-11-02T05:21:48+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-18442", "first_seen_at": "2026-11-02T05:21:18+00:00"}]
---

# Malicious code in litecore-lib-ltc (npm)

## Affected

- npm:litecore-lib-ltc affected all versions fixed ?

## Timeline

- 2026-11-02T05:21:18+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-18442

## From the sources

Malicious package. `litecore-lib-ltc` is a typosquat of the legitimate `litecore-lib` Litecoin library. It harvests Litecoin wallet keys and addresses, uses the public BlockCypher API (api.blockcypher.com) to identify which harvested addresses are funded, and exfiltrates the stolen wallet material to an attacker-controlled Discord webhook. Classification: cryptocurrency-wallet information stealer. The package provides no legitimate functionality distinct from this theft, so all published versions are malicious. Full indicators (including the complete webhook URL) are published at the reference below.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_