RAT
NodeCordRAT
NodeCordRAT is a cross-platform Remote Access Trojan and information stealer written in Node.js that targets Windows, macOS, and Linux systems through malicious NPM packages in software supply chain a
NodeCordRAT is a JavaScript rat.
Background
NodeCordRAT is a Node.js Remote Access Trojan and infostealer that works across Windows, macOS, and Linux, reaching victims via malicious NPM packages used in supply chain attacks. It fires automatically once a developer installs a tainted dependency, handing the operator wide-ranging access and data exfiltration. Among its features are remote code execution via a shell, stealing credentials from Google Chrome and MetaMask wallets, pulling secrets out of .env files, live screen capture, browsing and exfiltrating the whole file system, and collecting system details to profile victims. It keeps itself alive using process managers such as pm2 to run as a background service, and its C2 channel rides the Discord API over HTTPS with hardcoded bot tokens, letting the traffic blend in with normal web activity while the operator collects stolen data and sends commands through private Discord channels.
Source: Malpedia (Fraunhofer FKIE).