Malicious npm Package Impersonates Popular Nodemailer, Puts 3.9M Weekly Downloads at Risk of Crypto Theft

A sophisticated cryptocurrency theft scheme has emerged in which a malicious npm package, nodejs-smtp, impersonates the Nodemailer library that averages about 3.9 million weekly downloads. According to Socket’s Threat Research Team, the fraudulent package maintains full Nodemailer API compatibility while executing its payload in the background and presents copied documentation and styling to pass casual inspection.

The malware targets Atomic Wallet installations on Windows, unpacking the wallet’s app[.]asar file, replacing a vendor bundle with a malicious payload, and re-packaging the application to persist across reboots. It then silently overwrites recipient addresses during transactions to redirect funds to wallets controlled by the threat actor, affecting multiple cryptocurrencies including BTC, ETH, USDT and TRX USDT, XRP and SOL.

At the time of reporting the package remained active on npm, with Socket having petitioned the npm security team for its removal and suspension of the threat actor’s account; the package had accumulated 342 total downloads compared with Nodemailer’s millions of weekly downloads.