Atomic and Exodus crypto wallets targeted in malicious npm campaign

ReversingLabs discovered an active npm-based supply-chain campaign where a malicious package ('pdf-to-office') patched locally installed crypto wallet software (Atomic Wallet, Exodus) by injecting trojanized files that replace outgoing wallet addresses to divert funds, exhibited persistence after package removal, exfiltrated AnyDesk artifacts, targeted specific wallet versions, and was removed from npm after detection; the report includes IOCs and analysis of the attack techniques.