Tsundere Botnet Abusing Popular Node.js and Cryptocurrency Packages to Attack Windows, Linux, and macOS Users

Tsundere is a sophisticated, multi-platform botnet first observed in October 2024 and reported by researchers in mid-2025; attackers distributed it via 287 typosquatted npm packages and disguised game installers, targeting Windows (and initially Linux/macOS) users. The botnet achieves persistence with pm2 and registry entries, retrieves rotating C2 addresses from Ethereum smart contracts via public RPCs, establishes encrypted WebSocket communications, and executes dynamic JavaScript commands—making it resilient to IP-based blocking and enabling a criminal marketplace for renting or extending bot functionality.