Malicious npm Package Impersonates Popular Nodemailer, Puts 3.9M Weekly Downloads at Risk of Crypto Theft
## Cybersecurity: Cryptocurrency Theft via Malicious npm Package
Cybersecurity: Cryptocurrency Theft via Malicious npm Package
A recent investigation has uncovered a sophisticated scheme involving a malicious npm package that impersonates the popular Nodemailer email library. This package compromises desktop cryptocurrency wallets on Windows systems.
Socket's Threat Research Team identified the fraudulent package named nodejs-smtp , which masquerades as Nodemailer—a library with approximately 3.9 million weekly downloads. The malicious package maintains compatibility with Nodemailer’s API while executing harmful operations in the background.
The package appears as a legitimate email solution by copying documentation and styling from the original Nodemailer project, making it difficult to detect during casual inspections.
When installed, the package targets Atomic Wallet installations on Windows systems through the following steps:
Wallet Modification Process : Utilizes Electron tools to modify Atomic Wallet's app.asar file, inject a malicious payload, then repackages the application to erase traces. Transaction Hijacking : Overwrites recipient addresses during cryptocurrency transactions, redirecting funds to wallets controlled by attackers.
A recent investigation has uncovered a sophisticated scheme involving a malicious npm package that impersonates the popular Nodemailer email library.
The targeted cryptocurrencies include Bitcoin (BTC), Ethereum (ETH), Tether (USDT and TRX USDT), XRP, and Solana (SOL).
The modification remains active within the wallet's app.asar file and continues to function across system reboots unless the wallet software is reinstalled from official sources.
The design of the package complicates detection due to its plausible naming, increasing the likelihood that developers might install it without thorough verification. Additionally, AI code assistants may inadvertently recommend the malicious package.
This incident highlights the escalating risk of software supply chain attacks against cryptocurrency users. Recent campaigns have targeted various cryptocurrencies, with malicious packages appearing across npm and other ecosystems.
As of the reporting date, the nodejs-smtp package remained active on npm. Socket has requested its removal and the suspension of the associated account. The package had 342 downloads compared to Nodemailer's millions.
Security experts advise implementing supply chain security measures, including real-time package scanning, authenticity verification, and monitoring for suspicious behaviors. Organizations should deploy tools to detect filesystem manipulation during development.
This incident underscores the importance of vigilant dependency management and enhanced security measures to mitigate supply chain attacks targeting the cryptocurrency ecosystem.
Based on reporting by GBHackers.