Threat actors have deployed a deceptive npm package designed to compromise cryptocurrency wallets through a sophisticated supply chain attack. The package, named “pdf-to-office,” presents itself as a PDF-to-Word conversion utility while secretly targeting Atomic Wallet and Exodus cryptocurrency software.

“Effectively, a victim who tried to send crypto funds to another crypto wallet would have the intended wallet destination address swapped out for one belonging to the malicious actor,” explained ReversingLabs researcher Lucija Valentić.

Published on March 24, 2025, with its latest version (1.1.2) uploaded on April 8, the package has been downloaded 334 times. What makes this attack particularly concerning is its persistence mechanism—even if the malicious package is removed, the compromised wallet software remains infected.

## How the Attack Works

The malware specifically checks for Atomic Wallet installation in Windows systems by searching for “atomic/resources/app.asar” in the AppData directory. When detected, it overwrites legitimate files with trojanized versions that redirect cryptocurrency transactions to attacker-controlled wallets.

Similarly, the payload targets Exodus wallets by modifying the “src/app/ui/index.js” file. The attack specifically targets two versions each of Atomic Wallet (2.91.5 and 2.90.6) and Exodus (25.13.3 and 25.9.2).

“The only way to completely remove the malicious trojanized files from the Web3 wallets’ software would be to remove them completely from the computer, and re-install them,” Valentić noted.

## Related Threats

This discovery follows ReversingLabs’ recent identification of similar npm packages (ethers-provider2 and ethers-providerz) that infected local packages and established reverse shells.

In a separate but related development, ExtensionTotal identified 10 malicious Visual Studio Code extensions with over one million combined installations. These extensions downloaded PowerShell scripts that disabled Windows security, established persistence, and installed cryptocurrency mining software.

The malicious VS Code extensions included impersonations of popular tools like “Prettier — Code for VSCode,” “Discord Rich Presence,” and various compiler extensions for programming languages.