Researchers Uncover NodeCordRAT Hidden in npm Bitcoin-Themed Packages

Cybersecurity researchers have uncovered three malicious npm packages designed to deliver a previously undocumented malware named NodeCordRAT. The packages bitcoin-main-lib (2,300 downloads), bitcoin-lib-js (193 downloads), and bip40 (970 downloads) were uploaded by a user named “wenmoonx” and were taken down by November 2025.

The bitcoin-main-lib and bitcoin-lib-js packages execute a postinstall.cjs script during installation, which installs bip40 containing the NodeCordRAT payload, according to Zscaler ThreatLabz researchers Satyam Singh and Lakhan Parashar. NodeCordRAT uses npm as a propagation vector and Discord servers for command-and-control communications, and is capable of stealing Google Chrome credentials, API tokens, and seed phrases from cryptocurrency wallets such as MetaMask.

The malware traces the infected host to generate a unique identifier across Windows, Linux and macOS, and it exposes commands including !run to execute shell commands, !screenshot to capture a desktop screenshot, and !sendfile to upload files to a Discord channel, with data exfiltrated via Discord’s API using a hardcoded token.