A new malicious npm package impersonating the widely used nodemailer library has been uncovered by cybersecurity researchers. The package, named “nodejs-smtp,” not only functioned as an email sender but also injected code into desktop cryptocurrency wallets, silently redirecting transactions to wallets controlled by the attacker. When imported, nodejs-smtp used Electron tooling to tamper with Atomic Wallet on Windows. The package unpacked the app archive, replaced a vendor file with malicious code, repackaged the application, and then deleted traces of the process. Once active inside the wallet, the payload overwrote the recipient address during transactions with pre-set addresses tied to the attacker. This allowed for the theft of Bitcoin (BTC), Ethereum (ETH), Tether (USDT), TRX (USDT),…