Cybersecurity researchers have found a malicious npm package deal that comes with stealthy options to inject malicious code into desktop apps for cryptocurrency wallets like Atomic and Exodus on Home windows methods.
The package deal, named nodejs-smtp, impersonates the legit electronic mail library nodemailer with an an identical tagline, web page styling, and README descriptions, attracting a complete of 347 downloads because it was uploaded to the npm registry in April 2025 by a consumer named “nikotimon.” It is at present not out there.
“On import, the package deal makes use of Electron tooling to unpack Atomic Pockets’s app.asar, substitute a vendor bundle with a malicious payload, repackage the appliance, and take away traces by deleting its working listing,” Socket researcher Kirill Boychenko said.
The principle goal is to overwrite the recipient deal with with hard-coded wallets managed by the risk actor, redirecting Bitcoin (BTC), Ethereum (ETH), Tether (USDT and TRX USDT), XRP (XRP), and Solana (SOL) transactions, successfully appearing as a cryptocurrency clipper.
That having stated, the package deal delivers on its said performance by appearing as an SMTP-based mailer in an try and keep away from elevating builders’ suspicion.
The package deal nonetheless works as a mailer and exposes a drop-in interface suitable with nodemailer. That practical cowl lowers suspicion, permits utility assessments to go, and offers builders little cause to query the dependency.
The event comes months after ReversingLabs discovered an npm package deal named “pdf-to-office” that achieved the identical objectives by unpacking the “app.asar” archives related to Atomic and Exodus wallets and modifying inside them a JavaScript file to introduce the clipper perform.
“This marketing campaign reveals how a routine import on a developer workstation can quietly modify a separate desktop utility and persist throughout reboots,” Boychenko stated. “By abusing import time execution and Electron packaging, a lookalike mailer turns into a pockets drainer that alters Atomic and Exodus on compromised Home windows methods.”
