Security research firm Zscaler ThreatLabz has identified three malicious npm packages masquerading as Bitcoin-related libraries, which were downloaded over 3,400 times before being removed. The packages, named bitcoin-main-lib, bitcoin-lib-js, and bip40, were used to deploy a remote access trojan (RAT) called NodeCordRAT. This malware is capable of stealing Chrome login credentials, API tokens, and MetaMask wallet private keys or seed phrases, and it operates through command control via Discord servers. The malware activates through installation scripts without the developer's knowledge, highlighting the growing risk within the npm supply chain. Security teams are advised to remain vigilant as these threats continue to rise.