Cybersecurity researchers have identified three malicious npm packages that were distributing a previously undocumented remote access trojan (RAT) now known as NodeCordRAT. The packages, removed from npm in November 2025, were uploaded by a user operating under the name “wenmoonx.”
The affected packages include:
1. bitcoin-main-lib (2,300 downloads)
2. bitcoin-lib-js (193 downloads)
3. bip40 (970 downloads)
According to researchers at Zscaler ThreatLabz, the attack relies on abuse of npm’s post-installation scripting feature. When developers installed either bitcoin-main-lib or bitcoin-lib-js, a hidden postinstall.cjs script executed automatically, silently pulling in the third package, bip40, which contained the actual malicious payload.
The malware payload is known as NodeCordRAT, a cross-platform remote access trojan that uses npm for distribution and discord commands using Discord's servers for communication to conduct its activities. Once it is on the target system, the NodeCordRAT will find the target system’s fingerprints and create a unique ID for it and then build a hidden path of communication back to a secret Discord sever through the public APIs of Discord.
Using this hidden communication channel, the attacker can send commands to the infected system that will allow them to do things like the following:
1. !run -To execute arbitrary shell commands
2. !screenshot -To take full desktop screen shots and download them
3. !sendfile -To upload specific files from the victim's computer to the attacker.
This Remote Access Trojan can be used to compromise users’ accounts and steal their Google Chrome credentials and cryptocurrency related computer accounts (for example, stolen google chrome credentials and stolen API tokens can then be used to access cryptocurrency wallets created by the user using MetaMask).
The malware uses Discord as an anonymous means to send files and other types of data back to the attacker, which gives the attacker the ability to conceal malicious traffic in a way that looks like legitimate traffic on Discord. The researchers note that the package names used in NodeCordRAT are similar to legitimate libraries used in the popular bitcoinjs ecosystem (e.g., some of the package names included in the bitcoinjs ecosystem are bitcoinjs-lib, bip32 and bip38). Because of this, developers searching for Bitcoin libraries may accidentally download and install the NodeCordRAT package while searching for a trusted bitcoinjs package.
What is the Importance
As open-source software supply chain assault patterns increase, this campaign represents an increasing trend of open source supply chain assaults, where hackers will exploit the trust of developers, automated installations, and popular internet tools such as npm (Node Package Manager) and Discord to stay off of law enforcement authorities' radar.
If you do not have the necessary security measures in place, even the installation of a typical dependency could allow an attacker to take complete control of your computer/network.
Security Tips
In order to secure your network, developers and businesses should:
1. Review dependencies before installing them;
2. Do not trust packages with similar names to those you normally use;
3. Review npm package installations to look for undesired postinstall scripts; and
4. Limit outgoing connections to 3rd party services where possible.
Source: The Hacker News
