NodeCordRAT

NodeCordRAT is a cross-platform Remote Access Trojan and information stealer written in Node.js that targets Windows, macOS, and Linux systems through malicious NPM packages in software supply chain attacks. The malware executes automatically when developers unknowingly install compromised dependencies, providing attackers with comprehensive system access and data exfiltration capabilities. Its core functions include remote code execution through shell access, credential theft from Google Chrome and MetaMask wallets, extraction of developer secrets from .env files, live screen capture, complete file system navigation and exfiltration, and system information gathering for victim profiling. NodeCordRAT achieves persistence through process managers like pm2 that maintain the malware as a background service, while its command-and-control communications leverage the Discord API over HTTPS with hardcoded bot tokens, allowing malicious traffic to masquerade as legitimate web activity and enabling attackers to receive stolen data and issue commands through private Discord channels.

Family metadata imported from Malpedia (Fraunhofer FKIE).