Three Malicious NPM Packages Attacking Developers to Steal Login Credentials

Cybersecuritynews •Tushar Subhra Dutta • January 8, 2026

Three malicious npm packages are targeting JavaScript developers to steal browser logins, API keys, and cryptocurrency wallet data. The packages, named bitcoin-main-lib, bitcoin-lib-js, and bip40, were uploaded to the public npm registry and posed as tools linked to the popular bitcoinjs project. Any developer who added them as dependencies could silently install a new remote […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious npm Packages Target Developers to Steal Credentials Three malicious npm packages, bitcoin-main-lib, bitcoin-lib-js, and bip40, have been uploaded to the public npm registry, targeting JavaScript developers to steal sensitive data such as browser logins, API keys, and cryptocurrency wallet information. These packages masqueraded as tools related to the popular bitcoinjs project, posing a significant risk to developers who unknowingly added them as dependencies. 3 sources 29

Extracted Entities

Three Malicious NPM Packages Attacking Developers to Steal Login Credentials

The full story

Extracted Entities

Attack Types (1)

Platforms (1)

Tools (3)