Malicious npm packages delivered the NodeCordRAT remote access trojan

In November 2025, researchers at Zscaler ThreatLabz uncovered three malicious npm packages, bitcoin-main-lib, bitcoin-lib-js and bip40, that installed a new remote access trojan called NodeCordRAT. The malware could steal credentials, browser session data, API tokens and cryptocurrency wallet secrets including MetaMask data, and communicated with the attackers via Discord. The typosquatted packages have since been removed from the npm registry.

What this means for your organisation

The attack targets the development environment, not production servers. A developer who installs the wrong package gives the attacker whatever the developer has: source code, cloud access keys and active sessions. Because command traffic ran over Discord, it looks like ordinary use of a known service. The incident is a reminder that supply chain risk also covers open package registries with no formal vendor behind them.

Berigo recommends

• Introduce an internal mirror or approval list for third-party packages so new dependencies are not pulled straight from the public registry.
• Block or log outbound traffic from developer machines and build servers to services not needed for the work.
• Ensure access keys used in the development environment are short-lived and easy to rotate.
• Make typosquatting a standing check in code review: new dependencies must be justified and verified, not merely compile.

Source

• zscaler.com