Researchers at Zscaler ThreatLabz have found three malicious Bitcoin npm packages that are meant to implant malware named NodeCordRAT. Reports say that they all got more than 3,400 downloads before th...

<div><div>
<p><strong>Researchers at Zscaler ThreatLabz have found three malicious Bitcoin npm packages that are meant to implant malware named NodeCordRAT. Reports say that they all got more than 3,400 downloads before they were taken down from the npm registry.</strong></p>
<adv/><p>The packages, which include bitcoin-main-lib, bitcoin-lib-js, and bip40, had amassed 2,300, 193, and 970 downloads. By copying names and details from real Bitcoin components, the attacker made these lookalike modules appear harmless at a glance.</p>
<adv/><p><em>“The bitcoin-main-lib and bitcoin-lib-js packages execute a postinstall.cjs script during installation, which installs bip40, the package that contains the malicious payload,” </em>Zscaler ThreatLabz researchers Satyam Singh and Lakhan Parashar said. <em>“This final payload, named NodeCordRAT by ThreatLabz, is a remote access trojan (RAT) with&gt;NodeCordRAT is equipped to steal Google Chrome credentials</em></p>
<p>Zscaler ThreatLabz analysts identified the trio in Nov while scanning the npm registry for suspicious packages and strange download patterns. NodeCordRAT represents a new malware family that leverages Discord servers for command-and-control (C2) communication.</p>
<p>NodeCordRAT was built to steal Google Chrome login information, API codes kept in.env files, and MetaMask wallet data like private keys and seed phrases. The person who posted all three malicious packages used the email address supertalented730@gmail.com.</p>
<p>The attack chain begins when developers unknowingly install bitcoin-main-lib or bitcoin-lib-js from npm. Then it identifies the path of the bip40 package and starts it in detached mode using PM2.</p>
<div>
<figure><img src="https://cnews24.ru/uploads/c71/c7156b2faa1b6dcd2c62ed1892e9693b73e6a353.png"/>
<div>The attack flow. Source: Zscaler ThreatLabz</div>
</figure>
</div>
<p>The malware generates a unique identifier for compromised machines using the format platform-uuid, such as win32-c5a3f1b4. It achieves this by extracting system UUIDs through commands like wmic csproduct get UUID on Windows or reading /etc/machine-id on Linux systems.</p>
<h3>Malicious node packages that caused crypto thefts</h3>
<p>Trust Wallet said that the theft of almost $8.5 million was connected to an attack on the npm ecosystem supply chain by “Sha1-Hulud NPM.” More than 2,500 wallets were affected.</p>
<p>Hackers used a hacked npm as NodeCordRAT-style trojans and supply chain malware. It was incorporated into client-side code that stole money from customers when they accessed their wallets.</p>
<p>Other 2025 examples that fall into two buckets that resemble the NodeCordRAT style threat include the Force Bridge exploit, which occurred between May and June 2025.  Attackers stole either the software or the private keys that validator nodes used to authorize cross-chain withdrawals. This turned nodes into malicious actors that could approve fraudulent transactions.</p>
<p>This breach resulted in an estimated $3.6 million in stolen assets, including ETH, USDC, USDT, and other tokens. It also forced the bridge to stop operations and conduct audits.</p>
<p>In September, the Shibarium Bridge exploit unfolded, and attackers were able to take control of most of the validator power for a short time. As revealed by Cryptopolitan, this let them serve as bad validator nodes, sign off on illegal withdrawals, and take around $2.8 million in SHIB, ETH, and BONE tokens.</p>

</div></div>

Malicious Bitcoin npm packages spread NodeCordRAT malware before takedown

Zscaler ThreatLabz 的研究人員發現了三個惡意比特幣 npm 包，它們旨在植入名為 NodeCordRAT 的惡意軟件。報告稱，這些包在被發現之前下載量均超過 3400 次……

<div><div><p><strong>Zscaler ThreatLabz 的研究人員發現了三個惡意比特幣 npm 包，它們旨在植入名為 NodeCordRAT 的惡意軟件。報道稱，在從 npm 註冊表中移除之前，這些包的下載量均超過 3400 次。</strong></p><adv/><p>這些軟件包，包括 bitcoin-main-lib、bitcoin-lib-js 和 bip40，分別累計下載量達到 2300 次、193 次和 970 次。攻擊者通過複製真實比特幣組件的名稱和詳細信息，使這些外觀相似的模塊乍一看似乎無害。</p><adv/><p> Zscaler ThreatLabz 的研究人員 Satyam Singh 和 Lakhan Parashar 表示： <em>“bitcoin-main-lib 和 bitcoin-lib-js 軟件包在安裝過程中會執行 postinstall.cjs 腳本，該腳本會安裝 bip40 軟件包，而 bip40 正是包含惡意載荷的軟件包。ThreatLabz</em><em>將最終載荷命名為 NodeCordRAT，它是一種遠程訪問木馬 (RAT)，能夠竊取 Google Chrome 憑據。”</em></p><p> Zscaler ThreatLabz 分析師在 11 月掃描 npm 註冊表以查找可疑軟件包和異常下載模式時發現了這三個惡意軟件。NodeCordRAT 代表了一種新型惡意軟件家族，它利用 Discord 服務器進行命令與控制 (C2) 通信。</p><p> NodeCordRAT旨在竊取谷歌Chrome瀏覽器的登錄信息、保存在.env文件中的API代碼以及Metamask錢包數據，例如私鑰和助記詞。發佈這三個惡意軟件的人使用了supertalented730@gmail.com這個郵箱地址。</p><p>攻擊鏈始於開發者在不知情的情況下通過 npm 安裝了 bitcoin-main-lib 或 bitcoin-lib-js。然後，它會識別 bip40 包的路徑，並使用 PM2 以分離模式啟動它。 </p><div><figure><img src="https://cnews24.ru/uploads/c71/c7156b2faa1b6dcd2c62ed1892e9693b73e6a353.png"/><div>攻擊流程。來源：Zscaler ThreatLabz</div></figure></div><p>該惡意軟件使用 platform-uuid 格式為受感染的計算機生成唯一標識符，例如 win32-c5a3f1b4。它通過在 Windows 上使用 wmic csproduct get UUID 等命令或在 Linux 系統上讀取 / ETC/machine-id 來提取系統 UUID 來實現這一點。</p><h3>導致加密貨幣盜竊的惡意節點軟件包</h3><p>Trust Wallet表示，近850萬美元的損失與“Sha1-Hulud NPM”對npm生態系統供應鏈的攻擊有關。超過2500個錢包受到影響。</p><p>黑客利用被篡改的 npm 庫，將其用作類似 NodeCordRAT 的木馬程序和供應鏈惡意軟件。該惡意軟件被植入客戶端代碼，在用戶訪問錢包時竊取資金。</p><p>其他一些與NodeCordRAT威脅類似的2025年案例包括Force Bridge漏洞利用事件，該事件發生在2025年5月至6月之間。攻擊者竊取了驗證節點用於授權跨鏈提現的軟件或私鑰。這使得節點變成了可以批准欺詐交易的惡意行為者。</p><p>此次安全漏洞導致約 360 萬美元的資產被盜，其中包括ETH、 USDC、 USDT和其他代幣。此次漏洞還迫使該橋接服務停止運行並進行審計。</p><p> 9 月份，Shibarium Bridge 漏洞被利用，攻擊者在短時間內控制了大部分驗證節點的算力。據 Cryptopolitan 報道，這使得攻擊者能夠充當惡意驗證節點，批准非法提現，並竊取了價值約 280 萬美元的SHIB、 ETH和 BONE 代幣。</p></div></div>

惡意比特幣 npm 包在被下架前傳播了 NodeCordRAT 惡意軟件

美國國會議員拜倫·唐納茲本週公開登記購買了價值10萬鎂的比特幣。此舉令人驚訝，因為他目前是數字資產小組委員會的成員……

美國一位知名議員購買了價值 10 萬鎂的比特幣——《清晰法案》即將通過嗎？

美國最高法院今天並未就一項關鍵案件作出裁決，該案件旨在檢驗唐納德·特朗普總統在全球範圍內實施的全面關稅的合法性。

法院僅就……作出了裁決。

預計川普今天將在美國做出影響比特幣和山寨幣的決定——最新情況已經揭曉。

全球最大穩定幣發行商 Tether 宣布與聯合國毒品和犯罪問題辦公室（UNODC）展開合作，將透過區塊鏈技術加 […]
〈Tether 合作聯合國：加強改善非洲毒品犯罪、網路安全、保護人口免受販賣〉這篇文章最早發佈於動區BlockTempo《動區動趨-最具影響力的區塊鏈新聞媒體》。