Discord Controlled NodeCordRAT Steals Chrome Data via NPM Packages

Zscaler ThreatLabz uncovered a malicious supply-chain campaign on NPM where three packages (bip40, bitcoin-lib-js, bitcoin-main-lib) impersonating bitcoinjs libraries delivered a Remote Access Trojan called NodeCordRAT. The attacker chained packages so installing two of them pulled in the payload (bip40), and the RAT uses Discord as a C2 channel with commands to execute shell commands, capture screenshots, and exfiltrate files; it specifically targets Chrome credentials, MetaMask seed phrases, API secrets and .env files. Although the packages have been removed from NPM, thousands of downloads mean many users and developers could already be compromised.