2026-01-09 00:01:16

A serious security incident has recently come to light. Security teams discovered three malicious packages impersonating Bitcoin-related libraries—bitcoin-main-lib, bitcoin-lib-js, and bip40—in the npm open-source registry. These packages had been downloaded over 3,400 times before being removed.

These malicious packages contain a remote control Trojan called NodeCordRAT. If you accidentally install it, the consequences can be severe: it can extract your login credentials directly from Chrome, steal various API tokens, and most critically, it can target your MetaMask wallet—your private keys and seed phrases can all be stolen. Imagine someone gaining access to your wallet keys.

Even more frightening, once infected, this Trojan can transmit your data back through multiple channels, making it difficult to defend against.

For developers, this is a direct warning:

1. **Be cautious when downloading open-source packages** — verify the package name, check if the GitHub project exists, and look at the star count and update frequency.

2. **Protect your MetaMask wallet** — regularly check wallet activity, avoid logging in on unfamiliar computers, and consider using hardware wallets for critical operations.

3. **Pay attention to browser credentials** — change passwords regularly, and ensure your browser is clean before performing large transactions.

4. **Isolate API tokens** — don’t give a token too many permissions; use different tokens for different scenarios, and rotate them periodically.

Events like this remind us that ultimately, the responsibility for Web3 security falls on the users. Stay vigilant and avoid unnecessary risks.

BTC-0,57%

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

14 Likes

Reward
14
4
Repost
Share

Comment

0/400

HalfIsEmpty

· 01-09 00:22

Here comes the trick to scam downloads again, npm needs to improve its review process.

View OriginalReply0

0xLuckbox

· 01-09 00:22

Another wave of malicious packages, over 3400 people affected. I’ve been saying npm needs to take this more seriously... --- Installing new packages every day, who really verifies them? This time, it’s a lesson learned. --- The moment the private key was stolen, I guess people just lost it. MetaMask really needs to use hardware wallets to be secure. --- The thing people in crypto fear the most is this silent threat; it’s hard to defend against. --- Developers now have to be as cautious as white-hat hackers. Just installing a package requires a full review. --- The point about token permission isolation is correct. I’ve been doing that for a long time—if a token can be drained, it really can. --- Three fake packages with pretty convincing names. Without careful inspection on GitHub, it’s easy to fall for them. --- No matter how expensive hardware wallets are, they’re still cheaper than having your addresses washed. This incident proved that again. --- NodeCordRAT sounds really sinister; multi-channel data exfiltration makes it impossible to block. --- They say Web3’s decentralization makes it safer, but in the end, it still depends on us to stay vigilant. How ironic.

View OriginalReply0

MevWhisperer