GCVE-110-OSM-2026-14398

Malicious package. `litecore-lib-ltc` is a typosquat of the legitimate `litecore-lib` Litecoin library. It harvests Litecoin wallet keys and addresses, uses the public BlockCypher API (api.blockcypher.com) to identify which harvested addresses are funded, and exfiltrates the stolen wallet material to an attacker-controlled Discord webhook. Classification: cryptocurrency-wallet information stealer. The package provides no legitimate functionality distinct from this theft, so all published versions are malicious. Full indicators (including the complete webhook URL) are published at the reference below. ENTRY src/index.js (main: src/index.js) DESTINATION - 6 exfil (reconstructed, custom-c2, discord-webhook) (values recorded in verified_iocs) EXFIL - Webhook Data Exfiltration in src/wallet.js: "discord.com/api/webhooks/1477797533999956131/xMuQGOdbHRM6knCPHxXdIlN8FsmE0mSkSdF..." - Network Request in src/api.js: "axios.get(" - Network Request in src/wallet.js: "axios.post(" OBFUSCATION - recovered 2 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in src/api.js: "https://api.blockcypher.com/v1/ltc/main/txs/push" - Publisher Has Other Malicious Packages - Rapid Version Publishing PAYLOAD FILES src/api.js (+ src/wallet.js)