Researchers Uncover NodeCordRAT Hidden in npm Bitcoin-Themed Packages
嗯，用户让我帮忙总结一下这篇文章的内容，控制在一百个字以内，而且不需要用“文章内容总结”或者“这篇文章”这样的开头。直接写文章描述即可。 首先，我需要仔细阅读这篇文章。文章讲的是网络安全研究人员发现了三个恶意的npm包，这些包被用来传播一种新的恶意软件NodeCordRAT。这三个包分别是bitcoin-main-lib、bitcoin-lib-js和bip40，下载量分别是2300、193和970次。它们都是由一个叫wenmoonx的用户上传的。 然后，这些包在安装时会执行postinstall.cjs脚本，进而安装bip40这个包含恶意负载的包。NodeCordRAT是一种远程访问木马，具有窃取数据的能力，比如Google Chrome的凭证、API令牌以及加密货币钱包如MetaMask的种子短语。 此外，研究人员提到这些包的名字模仿了合法的bitcoinjs项目中的仓库名称。恶意软件还会通过Discord服务器进行命令和控制通信，并利用硬编码的Discord服务器来建立隐蔽的通信渠道，接收指令并执行各种操作，比如运行任意shell命令、截图并上传文件等。 最后，用户可能需要一个简洁明了的总结，重点突出恶意软件的功能、传播方式以及危害。所以，在总结时要涵盖这些关键点：发现三个恶意npm包、传播NodeCordRAT、窃取数据、通过Discord通信等。 现在我得把这些信息浓缩到100字以内，并且不使用特定开头。确保涵盖主要攻击手段和影响。 </think> 网络安全研究人员发现三个恶意npm包（bitcoin-main-lib、bitcoin-lib-js、bip40），用于传播名为NodeCordRAT的新恶意软件。该软件通过Discord服务器进行远程控制，窃取Chrome凭证、API令牌及加密货币钱包信息，并利用postinstall脚本传播。 2026-1-8 10:31:0 Author: thehackernews.com(查看原文) 阅读量:1 收藏

NodeCordRAT Hidden in npm

Cybersecurity researchers have discovered three malicious npm packages that are designed to deliver a previously undocumented malware called NodeCordRAT.

The names of the packages, all of which were taken down as of November 2025, are listed below. They were uploaded by a user named "wenmoonx."

"The bitcoin-main-lib and bitcoin-lib-js packages execute a postinstall.cjs script during installation, which installs bip40, the package that contains the malicious payload," Zscaler ThreatLabz researchers Satyam Singh and Lakhan Parashar said. "This final payload, named NodeCordRAT by ThreatLabz, is a remote access trojan (RAT) with data-stealing capabilities."

NodeCordRAT gets its name from the use of npm as a propagation vector and Discord servers for command-and-control (C2) communications. The malware is equipped to steal Google Chrome credentials, API tokens, and seed phrases from cryptocurrency wallets like MetaMask.

Cybersecurity

According to the cybersecurity company, the threat actor behind the campaign is assessed to have named the packages after real repositories found within the legitimate bitcoinjs project, such as bitcoinjs-lib, bip32, bip38, and bip38.

Both "bitcoin-main-lib" and "bitcoin-lib-js" include a "package.json" file that features "postinstall.cjs" as a postinstall script, leading to the execution of "bip40" that contains the NodeCordRAT payload.

The malware, besides fingerprinting the infected host to generate a unique identifier across Windows, Linux, and macOS systems, leverages a hard-coded Discord server to open a covert communication channel to receive instructions and execute them -

  • !run, to execute arbitrary shell commands using Node.js' exec function
  • !screenshot, to take a full desktop screenshot and exfiltrate the PNG file to the Discord channel
  • !sendfile, to upload a specified file to the Discord channel

"This data is exfiltrated using Discord's API with a hardcoded token and sent to a private channel," Zscaler said. "The stolen files are uploaded as message attachments via Discord's REST endpoint /channels/{id}/messages."

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.


文章来源: https://thehackernews.com/2026/01/researchers-uncover-nodecordrat-hidden.html
如有侵权请联系:admin#unsafe.sh