NodeCordRAT Malware — Analysis, Campaigns & Threat Activity

Threat entity extracted from intelligence sources

Frequency

2

occurrences

First Seen

January 8, 2026

Last Seen

January 9, 2026

Related Threat Clusters

Malicious npm Packages Deploy NodeCordRAT to Target Cryptocurrency Developers
In November 2025, Zscaler ThreatLabz identified three malicious npm packages designed to target cryptocurrency developers. The packages, bitcoin-main-lib and bitcoin-lib-js, install a third package, bip40, which…

2 articles · Updated January 9, 2026

Recent Intelligence Reports

Malicious npm packages spread novel NodeCordRAT malware — Scworld · January 9, 2026
Malicious NPM Packages Deliver NodeCordRAT | ThreatLabz — Zscaler · January 8, 2026

Related Entities

Malware Supply Chain Attack Command And Scripting Interpreter Credentials From Web Browsers Credentials In Files Exfiltration Over C2 Channel Obfuscated Files Or Information System Information Discovery System Network Configuration Discovery Discord Node.js Npm