As cited
Copy frozen at (site build).
threat intel
Malicious NPM Packages Deliver NodeCordRAT
Zscaler ThreatLabz identified three malicious npm packages in November 2025 that delivered NodeCordRAT, a new remote access trojan using Discord for command-and-control communication. The packages used names resembling legitimate Bitcoin libraries to deceive developers, with one wrapper package requiring installation of the actual malicious payload. NodeCordRAT steals Chrome credentials, environment configuration files, MetaMask wallet data, and can execute remote commands and capture screenshots.
Why it matters: Developers using npm are at risk of installing trojanized Bitcoin libraries that grant attackers remote shell access and credential theft; review project dependencies for bitcoin-main-lib, bitcoin-lib-js, and bip40 versions from November 2025 and monitor for unexpected pm2 processes running in the background.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Malicious NPM Packages Deliver NodeCordRAT
Zscaler ThreatLabz identified three malicious npm packages in November 2025 that delivered NodeCordRAT, a new remote access trojan using Discord for command-and-control communication. The packages used names resembling legitimate Bitcoin libraries to deceive developers, with one wrapper package requiring installation of the actual malicious payload. NodeCordRAT steals Chrome credentials, environment configuration files, MetaMask wallet data, and can execute remote commands and capture screenshots.
Why it matters: Developers using npm are at risk of installing trojanized Bitcoin libraries that grant attackers remote shell access and credential theft; review project dependencies for bitcoin-main-lib, bitcoin-lib-js, and bip40 versions from November 2025 and monitor for unexpected pm2 processes running in the background.
- Source published
- First seen by Cybersecurity Tracker