Malicious npm Package Masquerades as Nodemailer, Drains Crypto Wallets

Researchers from Socket’s Threat Research Team disclosed a dangerous npm package, nodejs-smtp, which impersonates nodemailer to infiltrate development environments and drain cryptocurrency wallets. The package, published under the alias nikotimon, includes a functional mailer API so it still works as a drop-in nodemailer substitute, lowering suspicion and allowing tests to pass.

On import, it targets Atomic Wallet, using Electron tooling to unpack app[.]asar, replace a vendor bundle with a malicious payload, repackage the application, and delete its working directory to remove traces. Once inside the wallet runtime, the injected code silently hijacks outgoing transactions by overwriting the recipient address during the send flow so funds go to wallets controlled by the threat actor.

The hardcoded addresses cover Bitcoin, Ethereum, Tether, XRP and Solana, enabling theft across major cryptocurrencies. At the time of disclosure, the threat actor had not accumulated significant funds, though Socket warns the tooling is deliberate, reusable and scalable and urges removal from ecosystems before it can cause substantial harm. The actor is associated with the email darkhorse.tech322@gmail[.]com.