NodeCordRAT Malware Removal: Fake npm Packages and Stolen Secrets Explained

A Bitcoin-related package looks like the missing piece your project needs. You install it, resolve another dependency, and expect to get back to work.

When NodeCordRAT appears in a security alert afterward, the important questions are what ran during installation and which information the development environment could expose.

Overview

What NodeCordRAT does

NodeCordRAT is a Node.js remote access trojan distributed through malicious npm packages, not an official component of the legitimate bitcoinjs project.

Once running, NodeCordRAT used Discord for commands and file transfers. Its capabilities included remote shell access, screenshots, and collection of sensitive local files.

How the malicious packages get onto a computer

Zscaler ThreatLabz identified bitcoin-main-lib, bitcoin-lib-js, and bip40 in the campaign. Their names resembled genuine Bitcoin-development libraries, making a mistaken installation easier.

The first two acted as wrappers around the malicious bip40 payload. Links to a genuine repository inside package metadata did not make those separately published packages trustworthy.

Installation scripts automate execution once the required components are available. A separate double-click on a conspicuously named malware program is not necessary.

Which information is at risk

A development account may have access to personal browser data and production secrets at the same time. That makes a compromised workstation unusually valuable.

• Chrome login databases and associated browser configuration were collection targets.
• Files with .env in their names could contain service credentials or API tokens.
• MetaMask extension database files were targeted for copying.
• Remote commands could extend activity beyond the initial automatic collection.

Disconnect an affected computer and stop builds using the suspect dependencies. On a work device or CI runner, contact security before restarting or cleaning.

How to Remove NodeCordRAT From Windows

For a work or school computer, contact its IT or security team before installing tools or restarting. Its investigation may need evidence from the running system.

If remote access is suspected, disconnect Wi-Fi or Ethernet and stop using this PC for sensitive accounts. Arrange trusted downloads and updates before proceeding with cleanup.

Start with Malwarebytes. HitmanPro and ESET are optional second opinions for unresolved findings or continuing symptoms. Run one scanner at a time.

• STEP 1: Use RKill only if malware blocks your scanner
• STEP 2: Scan and quarantine threats with Malwarebytes
• STEP 3: Optional: Check unresolved threats with HitmanPro
• STEP 4: Optional: Run a second-opinion scan with ESET

Step 1: Use RKill only if malware blocks your scanner

RKill attempts to stop known malware processes so your security software can run. It does not remove the infection.

Use it only on a personal Windows PC when malware is blocking your scanner. Otherwise, skip directly to Malwarebytes.

1. Download Rkill.

   Download RKill using the button below. On the download page, choose the iExplore.exe version.

   This is a renamed copy of RKill, provided for infections that block security tools by filename.

   RKillStops malware processes so other tools can run

   Download RKillOpens the BleepingComputer download page in a new tab.

2. Run RKill.

   Open your Downloads folder and double-click iExplore.exe. Allow the program time to finish checking for processes that interfere with cleanup.

   

   When the black window closes, a log opens. Keep the log, do not restart yet, and continue directly to Malwarebytes.

Step 2: Scan and quarantine threats with Malwarebytes

Malwarebytes for Windows can scan for malware and quarantine detected threats. Use the free Custom Scan below; a paid plan is not required for this cleanup.

1. Download Malwarebytes

   Click the button below to download Malwarebytes for Windows. Paid real-time protection is optional.

   Malwarebytes Free for WindowsScans and removes malware at no cost

   Download MalwarebytesMalwarebytes free scanner informationOfficial installer for Windows 11 and 10. Your download starts right away.Want real-time protection? See Malwarebytes Premium

2. Install Malwarebytes

   When the download finishes, open Downloads and double-click MBSetup. If Windows asks for permission, check that the prompt identifies Malwarebytes, then click Yes.

   

3. Follow the On-Screen Prompts to Install Malwarebytes

   The setup wizard will walk you through a few quick screens:

   Installer screens and optional offers vary. Skip unwanted Browser Guard, trial, or paid-plan offers. The free Custom Scan remains available; Threat Scan may require a paid plan.

   • Choose Personal for your own computer, then click Next. For a work-managed device, use your organization’s approved response instead.

     
     

   • Wait for installation to finish.

     
     

   • If the Welcome to Malwarebytes screen appears, click Get started and follow the remaining prompts.

     
     

   • On the final screen, click Open Malwarebytes to launch the program.

     
     

4. Choose the scan type and optional rootkit check

   On the Scanner tile, click the three dots, choose Advanced Scan, then Custom Scan.

   Expand the folder selector and select the C:\ system drive. Include any other drive where the suspicious files were stored.

   If Scan for rootkits is available, you can enable it. This setting is unavailable on Windows ARM devices; leave Windows security protections enabled.

   Review how potentially unwanted programs and modifications will be handled. Keep detection enabled rather than automatically ignoring these items.

5. Start the Scan

   Click Start Custom Scan. Allow Malwarebytes to update its detection information if prompted.

6. Wait for the Scan to Finish

   Wait for the Custom Scan to finish. The time required depends on the selected locations and the amount of data.

7. Quarantine the Detected Threats

   When the scan finishes, review the detections and keep the threats you want removed selected. Click Quarantine.

   If a detection is unclear, save the report and ask for help before excluding or restoring it.

   

   Wait while Malwarebytes quarantines the selected items. Do not restore a file merely because an unfamiliar name appears in the results.

   

8. Restart Your Computer

   If Malwarebytes asks for a restart, save your work and click Yes. After signing back in, reopen Malwarebytes and check the report for unresolved detections.

   

Step 3: Optional: Check unresolved threats with HitmanPro

HitmanPro is a second-opinion scanner for Windows. It examines suspicious files using cloud analysis, including SophosLabs. An internet connection is needed for that check.

Scanning is free. Removing detections requires an eligible one-time 30-day trial or a paid license.

A computer that already used its trial may not qualify again. You do not have to buy HitmanPro to follow the Malwarebytes cleanup above.

1. Download HitmanPro

   Click the button below to download HitmanPro if you want a second opinion on unresolved symptoms or detections.

   HitmanProSecond-opinion malware scanner from Sophos

   Download HitmanProFree scan. Removal requires an eligible 30-day trial or a paid license. Opens the official HitmanPro page in a new tab.

2. Install HitmanPro

   When the download finishes, open your Downloads folder and double-click the file: “hitmanpro.exe” on 32-bit Windows, or “hitmanpro_x64.exe” on 64-bit Windows.

   

   If a User Account Control pop-up asks whether HitmanPro can make changes to your device, click “Yes” to continue.

   

3. Follow the On-Screen Prompts

   On the HitmanPro start screen, click Next. Read and accept the terms if you agree, then continue.

   

   Choose whether to keep a copy for later use or run a one-time scan. Review optional startup and email preferences, then click Next.

   

4. Wait for the Scan to Finish

   Let HitmanPro finish scanning. Review its findings once the scan has completed.

   

5. Review the Results and Click “Next”

   Review the detected items and their proposed actions. Save the log if you need help with an unfamiliar detection, then click Next to proceed.

   

6. Click “Activate Free License”

   If this computer qualifies, click Activate free license and follow the activation prompts.

   If no trial is available, use an existing license or save the report for assistance. Do not assume a purchase is necessary to continue cleanup.

   

   After removal, review the summary and click Next. Choose Reboot if requested, or Close if no restart is needed.

   If detections return or the original symptoms persist, keep the reports and ask for help. A clean scan cannot rule out every threat.

Step 4: Optional: Run a second-opinion scan with ESET

ESET Online Scanner is a free second-opinion scanner for Windows. Use it if you need another check after cleanup, rather than running several scanners together.

1. Download ESET Online Scanner

   Click the button below to download ESET Online Scanner.

   ESET Online ScannerFree one-time malware scan from ESET

   Download ESET Online ScannerOpens the official download page in a new tab.

2. Run the Installer

   When the download finishes, open Downloads and double-click esetonlinescanner.exe. Approve the Windows permission prompt after checking that it identifies ESET.

   

3. Install ESET Online Scanner

   On the start screen, select your language from the drop-down menu and click Get started.

   

   Read the Terms of use. Click Accept if you agree, then Get started if that screen appears again.

   

   Choose your preferences for the Customer Experience Improvement Program and the Detection feedback system (either choice is fine), then click Continue.

   

4. Start a Full Scan

   Click Full Scan for a broader check than the quick-scan option.

   

   Select Enable for Detection of Potentially Unwanted Applications. Then click Start scan.

   

5. Wait for the Scan to Finish

   Allow the detection modules to download and update. The file scan begins afterward.

   Leave the scan running until it finishes. A full scan can take an hour or longer, depending on your computer and the data being checked.

   

6. Review the Results

   When the scan finishes, open View detailed results and check the action recorded for each detection.

   ESET attempts to clean and quarantine detected threats. If an item remains unresolved, keep its details for assistance.

   Click Save scan log to keep the results. Then click Continue.

   

   Restart if ESET requests it. Afterward, check whether detections or the original symptoms return.

   If problems continue, keep the scan reports and ask for help in the MalwareTips removal forum. Do not repeatedly restore quarantined files.

What to Do After Removing NodeCordRAT

1. Replace exposed development secrets. From trusted equipment, revoke affected cloud, deployment, package-registry, and API credentials through the services that issued them.

   Changing a local .env file does not invalidate the old secret at the service that accepts it.

2. Repair the project’s dependencies. Preserve package.json, lockfiles, install logs, and package versions before rebuilding from verified inputs.

   Do not rerun the suspect package’s scripts while trying to uninstall it. Examine caches and build artifacts before allowing automation to reinstall the same dependency.

3. Check browser and wallet access. Change exposed passwords, end suspicious sessions, and review authorized devices from a clean computer.

   Use MetaMask’s compromised-wallet guidance if that wallet is involved. Create any necessary replacement securely, with genuinely new recovery credentials.

   If you suspect a sweeper controls the wallet, do not add funds for transaction fees. It can take the deposit before you move your assets.

PM2 and Non-Windows Systems

The analyzed launch script used the PM2 process manager to start bip40 detached from the installer. That allowed the process to continue after installation ended.

PM2 could restart it after a crash during the current session. This configuration did not, by default, establish automatic persistence across a reboot.

Do not terminate every Node.js or PM2 service. Both have legitimate uses, and stopping unrelated production services can create damage without resolving the incident.

The Windows guide does not clean macOS, Linux, or CI runners. Pause affected jobs and involve the administrator responsible for that environment.

For disposable runners, replace the environment from trusted images and corrected dependencies after evidence preservation. Revoke secrets outside the runner before granting the replacement new credentials.

Check build outputs before resuming publishing

If the system held signing material or controlled production releases, investigate downstream builds and published artifacts. A workstation incident can become a supply-chain incident for its users.

Keep the runner image, affected build times, dependency versions, and artifacts produced during those jobs. Pause publishing until the replacement environment uses reviewed dependencies.

Replace signing or deployment credentials that were accessible during execution. Do not give a rebuilt runner the old secret simply because its filesystem is new.

Check package-registry access logs for unexpected releases, changed maintainers, or new tokens during the affected period.

Frequently Asked Questions

Is NodeCordRAT part of the real bitcoinjs project?

No. The campaign used independently published malicious packages with convincing names and legitimate-looking repository references. That does not implicate the genuine bitcoinjs libraries.

Can npm installation itself execute the trojan?

Yes. The documented installation scripts launch the payload when their requirements are present. You do not have to deliberately call the malicious package from application code.

Does the analyzed PM2 configuration survive a reboot?

It did not automatically configure reboot persistence. It kept the process running and restarted it within the current session.

Will uninstalling Discord solve the problem?

No. The malware uses Discord’s API for communication. Removing the legitimate chat application does not remove an independently running Node.js trojan.

Does a stolen MetaMask database mean my recovery phrase was decrypted?

Not necessarily. A copied encrypted wallet file and an exposed recovery phrase require different responses. If the phrase escaped, changing the wallet password is insufficient.

Is deleting the malicious package enough?

No. Review running processes, additional changes, accessible secrets, sessions, and build outputs. A corrected dependency cannot revoke a token or retrieve information already stolen.

The Bottom Line

Do not install or keep using bitcoin-main-lib, bitcoin-lib-js, or bip40 from the NodeCordRAT campaign. Isolate any environment where their installation scripts ran.

Preserve the dependency trail, clean or rebuild the affected system appropriately, and replace exposed credentials from trusted equipment. Treat project repair and stolen-secret recovery as separate jobs.