cyber.hendryadrian.com
Threat Research · zscaler.com

Malicious npm Packages Deliver NodeCordRAT, Stealing Credentials and Crypto Data

· Original article ↗

Summary

ThreatLabz found three malicious npm packages that install NodeCordRAT, a RAT using Discord for command-and-control and targeting Chrome credentials, secrets, and MetaMask data. The packages have been removed from npm.

Key points

  • ThreatLabz identified bitcoin-main-lib, bitcoin-lib-js, and bip40 in November 2025; the first two run an installation script that installs bip40, which contains NodeCordRAT.
  • The package names mimic repositories in the legitimate bitcoinjs project, and the packages recorded several thousand downloads.
  • NodeCordRAT fingerprints infected hosts and uses a hardcoded Discord server and private channels for command-and-control.
  • Its commands can execute shell instructions, capture screenshots, and upload files from infected machines.
  • The malware targets Chrome credentials, files containing .env in users’ home directories, and MetaMask wallet data, including keys and seed phrases.
  • The packages have been removed from npm.

Article Details

Attack Vectors
  • Malicious npm packages bitcoin-main-lib and bitcoin-lib-js run postinstall.cjs to install bip40, which contains the NodeCordRAT payload; bip40 can also be installed directly.
  • The packages use name variations of legitimate bitcoinjs project repositories to deceive developers into downloading them.
Defensive Notes
  • The three identified malicious packages were removed from the npm database.
  • Review npm dependencies for the packages bitcoin-main-lib, bitcoin-lib-js, and bip40.

Indicators of compromise

TypeIndicatorContext
MD57a05570cda961f876e63be88eb7e12b8MD5 hash listed for the malicious npm package bitcoin-lib-js.
MD59a7564542b0c53cb0333c68baf97449cMD5 hash listed for the malicious npm package bip40.
MD5c1c6f4ec5688a557fd7cc5cd1b613649MD5 hash listed for the malicious npm package bitcoin-main-lib.

MITRE ATT&CK

T1005 · Data from Local SystemNodeCordRAT collects Chrome credential databases, .env files, and MetaMask wallet files from the infected system.T1059 · Command and Scripting InterpreterNodeCordRAT executes arbitrary shell commands through Node.js's exec function in response to the !run command.T1113 · Screen CaptureNodeCordRAT captures full-desktop screenshots using the !screenshot command.T1567 · Exfiltration Over Web ServiceNodeCordRAT uploads stolen files and screenshots to a private Discord channel using Discord's API.

Malware

NodeCordRATwhich installs bip40, the package that contains the malicious payload. This final payload, named NodeCordRAT by ThreatLabz, is a remote access trojan (RAT) with data-stealing capabilities. It is also possible to

Vendors

ZscalerZscaler ThreatLabz regularly monitors the npm database for suspicious packages. In November 2025, ThreatLabz identified three malicious packages: bitcoin-main-lib, bitcoin-lib-js, and bip40. The bitcoin-main-lib and

Products

Google ChromeNodeCordRAT targets Chrome credentials, sensitive secrets such as API tokens, and MetaMask (a popular cryptocurrency platform) data including keys and seed phrases.MetaMaskNodeCordRAT targets Chrome credentials, sensitive secrets such as API tokens, and MetaMask (a popular cryptocurrency platform) data including keys and seed phrases.npmZscaler ThreatLabz regularly monitors the npm database for suspicious packages. In November 2025, ThreatLabz identified three malicious packages: bitcoin-main-lib, bitcoin-lib-js, and bip40. The bitcoin-main-lib and

Tools

DiscordIn this blog post, ThreatLabz analyzes how NodeCordRAT uses Discord for command-and-control (C2), performs credential theft, and orchestrates remote shell access. Although the malicious packages have been removed from

Related Articles