Researchers Uncover NodeCordRAT Hidden in npm Bitcoin-Themed Packages

Cybersecurity researchers have discovered three malicious npm packages that are designed to deliver a previously undocumented malware called NodeCordRAT.

The names of the packages, all of which were taken down as of November 2025, are listed below. They were uploaded by a user named “wenmoonx.”

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

• bitcoin-main-lib (2,300 Downloads)
• bitcoin-lib-js (193 Downloads)
• bip40 (970 Downloads)

“The bitcoin-main-lib and bitcoin-lib-js packages execute a postinstall.cjs script during installation, which installs bip40, the package that contains the malicious payload,” Zscaler ThreatLabz researchers Satyam Singh and Lakhan Parashar said. “This final payload, named NodeCordRAT by ThreatLabz, is a remote access trojan (RAT) with data-stealing capabilities.”

NodeCordRAT gets its name from the use of npm as a propagation vector and Discord servers for command-and-control (C2) communications. The malware is equipped to steal Google Chrome credentials, API tokens, and seed phrases from cryptocurrency wallets like MetaMask.

According to the cybersecurity company, the threat actor behind the campaign is assessed to have named the packages after real repositories found within the legitimate bitcoinjs project, such as bitcoinjs-lib, bip32, bip38, and bip38.

Both “bitcoin-main-lib” and “bitcoin-lib-js” include a “package.json” file that features “postinstall.cjs” as a postinstall script, leading to the execution of “bip40” that contains the NodeCordRAT payload.

The malware, besides fingerprinting the infected host to generate a unique identifier across Windows, Linux, and macOS systems, leverages a hard-coded Discord server to open a covert communication channel to receive instructions and execute them –

• !run, to execute arbitrary shell commands using Node.js’ exec function
• !screenshot, to take a full desktop screenshot and exfiltrate the PNG file to the Discord channel
• !sendfile, to upload a specified file to the Discord channel

“This data is exfiltrated using Discord’s API with a hardcoded token and sent to a private channel,” Zscaler said. “The stolen files are uploaded as message attachments via Discord’s REST endpoint /channels/{id}/messages.”

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.