NodeCordRAT: The Trojan Hiding in NPM to Steal Crypto via Discord

NodeCordRAT is a sophisticated Remote Access Trojan found hiding in the npm registry, discovered in November 2025 and distributed through three malicious packages named bitcoin-main-lib, bitcoin-lib-js, and bip40 to harvest crypto wallets and credentials. The campaign relies on Discord as a covert command-and-control channel, using Discord’s API to blend malicious traffic with normal activity and to transfer stolen data as chat messages via a hardcoded bot token.

Once installed, typically through a postinstall script in the fake libraries, it targets Chrome credentials, crypto wallets such as MetaMask data (including the MetaMask extension ID nkbihfbeogaeaoehlefnkodbefgpgknn), and sensitive secrets by scanning for .env files. The stolen data is uploaded to a server and also sent as message attachments through Discord’s REST endpoint, with the malware even returning error messages to attackers if transfers fail, according to ThreatLabz. Although the three npm packages have been removed, ThreatLabz warns that similar supply-chain threats are likely to continue in the future.