NodeCordRAT: The Trojan Hiding in NPM to Steal Crypto via Discord

Zscaler ThreatLabz discovered NodeCordRAT, a supply-chain malware campaign delivered through three malicious npm packages (bitcoin-main-lib, bitcoin-lib-js, bip40) that impersonated bitcoinjs tools; the RAT uses postinstall scripts to collect Chrome login databases, MetaMask files, and .env secrets and uploads them via a hardcoded Discord bot to private channels, leveraging Discord’s API as C2 to evade detection. Developers are urged to verify library authenticity and exercise caution when importing packages related to cryptocurrency operations.