MalwarePublished 8 Jan 2026

Malicious NPM Packages Deliver NodeCordRAT

Source AlienVault OTX General

Description

Three malicious npm packages were discovered in November 2025, designed to deliver and install a new RAT malware family named NodeCordRAT. The packages, bitcoin-main-lib, bitcoin-lib-js, and bip40, mimicked legitimate Bitcoin-related libraries to deceive developers. NodeCordRAT uses Discord for command-and-control communication, targets Chrome credentials, sensitive secrets, and MetaMask data. It performs host fingerprinting, executes shell commands, captures screenshots, and exfiltrates data. The malware exploits software supply chain vulnerabilities, highlighting the importance of vigilance in package management. Although removed from npm, the incident serves as a reminder of ongoing threats in the software development ecosystem.

Impact

For European organizations, the impact of NodeCordRAT can be substantial, especially for those engaged in cryptocurrency, fintech, and software development sectors. The malware’s ability to steal browser credentials and MetaMask wallet data threatens the confidentiality of sensitive financial assets and user information. Host fingerprinting and shell command execution capabilities allow attackers to gain persistent and deep control over infected systems, potentially leading to data breaches, intellectual property theft, and lateral movement within networks. The use of Discord for command-and-control can evade traditional network security monitoring, increasing the risk of prolonged undetected compromise. Organizations relying on npm packages for development risk supply chain contamination, which can propagate malware into production environments. This could disrupt operations, damage reputations, and incur regulatory penalties under GDPR if personal data is compromised. The incident also raises concerns about the security of open-source software supply chains, which are integral to European digital infrastructure. Overall, the threat could lead to significant financial loss, operational disruption, and erosion of trust in software supply chains.

Defensive guidance

European organizations should implement a multi-layered approach to mitigate this threat: 1) Enforce strict vetting and validation of npm packages before inclusion in projects, including verifying package authorship and checking for suspicious package names mimicking legitimate libraries. 2) Employ automated tools to scan dependencies for known malicious indicators and anomalous behavior. 3) Monitor outbound network traffic for unusual connections to Discord or other uncommon C2 channels, using advanced network detection systems. 4) Implement credential protection mechanisms such as browser credential vaults, multi-factor authentication, and secrets management to reduce the impact of credential theft. 5) Use runtime application self-protection (RASP) and endpoint detection and response (EDR) solutions to detect suspicious shell command executions and screenshot captures. 6) Educate developers on supply chain risks and encourage the use of trusted package registries or private mirrors. 7) Regularly audit and update dependencies to remove any malicious or outdated packages. 8) Establish incident response plans specifically addressing supply chain compromises. These measures go beyond generic advice by focusing on supply chain hygiene, network anomaly detection, and credential security tailored to the NodeCordRAT threat vector.

Malicious NPM Packages Deliver NodeCordRAT

Description

Impact

Defensive guidance

Indicators of compromise

Hashes 3

Community reviews

Description

AI analysisMachine-generated, updated 8 Jan 2026, 12:50 UTC

Technical details

Indicators of compromise

Hashes 3

Community reviews

Related threats