Loading story…
Security researchers reported a supply-chain attack delivered via a malicious npm package, ansi-universal-ui, masquerading as a legitimate UI component library. The package, dubbed G_Wagon by Aikido, used a multi-stage infection chain: after installation it executed an obfuscated loader, downloaded its own Python runtime to evade local restrictions, and then ran a Python-based stealer that exfiltrated sensitive data including browser credentials, cryptocurrency wallets, cloud credentials, and Discord tokens to an Appwrite storage bucket. The campaign showed rapid iteration, with roughly 10 package versions published over two days, progressing from basic scaffolding to adding C2 configuration and a “full Python payload with browser injection.”
Technical analysis indicated the payload included a large base64 blob that decoded to an XOR-encrypted Windows DLL, which was injected into browser processes using Windows native APIs (e.g., NtAllocateVirtualMemory). Separately, reporting highlighted that npm and Yarn package-manager behaviors can leave “unplugged holes” that attackers may exploit to bypass certain defenses aimed at malicious dependency activity (referencing “Shai-Hulud”), reinforcing the broader risk that package-manager edge cases and ecosystem trust can be leveraged for supply-chain compromise. A paywalled report about a Firefox WebRTC RCE with public exploit code appears unrelated to the npm malware activity and does not materially contribute details to this incident.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Snyk published its assessment of the malicious package, rating the issue critical with a CVSS 4.0 score of 9.3 and classifying it under CWE-506. It warned that all versions of "ansi-universal-ui" were affected and should be avoided.
Following disclosure, researchers and vendors advised developers to remove the malicious package, delete related dependencies, check for the ~/.gwagon_status marker file, and rotate or revoke exposed credentials such as browser passwords, cloud keys, SSH keys, and tokens. Guidance also recommended reviewing systems and logs for signs of Appwrite-related exfiltration traffic.
Analysis of G_Wagon showed it downloaded its own Python runtime, executed payloads in memory, and used an embedded Windows DLL injected into browser processes via native APIs. The malware was found stealing browser credentials, crypto wallet data, cloud and infrastructure secrets, and communication-platform tokens, then exfiltrating them to attacker-controlled Appwrite storage.
On January 23, 2026, researchers identified "ansi-universal-ui" as a malicious npm package delivering the multi-stage G_Wagon infostealer. The package used a postinstall hook to fetch and run obfuscated payloads while posing as a lightweight UI component library.
The npm package "ansi-universal-ui" began a rapid series of malicious releases, evolving from initial scaffolding into a more capable infostealer delivery chain. Reporting indicates 10 versions were published over roughly two days, starting on January 21, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
snyk.io
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcecsoonline.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported two separate npm supply-chain compromises that delivered malware and exploit infrastructure to downstream users. One analysis uncovered an obfuscated Node.js stealer designed to run across **Windows via WSL, macOS, and Linux**, with plaintext modules for browser credential theft, recursive exfiltration of sensitive files, and a **WebSocket-based reverse shell**. The malware targeted Chromium-based browsers and cryptocurrency wallet extensions, sent browser data, files, and command traffic to `216.126.225.243` over ports `8085`, `8086`, and `8087`, and included host profiling plus an `HMAC-SHA256` routine with a hardcoded key. Researchers noted the command-and-control IP had previously been associated with **DPRK-linked OtterCookie** infrastructure. In a separate incident, Socket Threat Research said the widely used npm package **`art-template`** was compromised after repository control was transferred to an unknown actor, who inserted malicious remote-script loaders into versions **`4.13.5`** and **`4.13.6`**. The injected code redirected users to a watering-hole framework at `utaq.cfww.shop` that selectively targeted **Safari on iOS 11.0 through 17.2**, beaconed device and IP data to `l1ewsu3yjkqeroy.xyz`, and used anti-bot checks, anti-headless logic, and **WebAssembly-based fingerprinting** before retrieving gated payloads. Researchers found strong overlap with the **Coruna exploit kit**, including version-aware targeting, XOR obfuscation, architecture-specific dispatch, and a cutoff at **iOS 17.3**, with additional similarities noted to **UNC6691**.
Jun 29, 2026
Security researchers reported an npm supply-chain compromise involving a malicious package, `polymarket-clob`, that targeted cryptocurrency users by exfiltrating sensitive local files (including `.env`, `wallets.json`, and `keys/*.json`) to attacker-controlled infrastructure. The package was published in the npm registry, downloaded at least 189 times (lower bound), and later removed and replaced with a security placeholder; analysis of the code and infrastructure pivoting linked the campaign to broader activity consistent with wallet-drainer operations and **Vidar** stealer-related infrastructure, including reuse of SSH fingerprints and consistent hosting patterns. Separately, researchers disclosed **six JavaScript “zero-day” bypass issues** across multiple package managers—**npm, pnpm, vlt, and Bun**—that undermine common defensive controls used to reduce supply-chain risk, including disabling lifecycle scripts and relying on lockfile integrity. The issues (dubbed **“PackageGate”**) reportedly enable paths to regain install-time code execution or weaken integrity guarantees via mechanisms such as Git dependency handling, tar extraction behaviors, and incomplete integrity coverage for URL-based tarballs; pnpm, vlt, and Bun were reported as patched, while npm characterized the behavior as “works as expected,” raising concern that package-manager-level weaknesses could enable large-scale compromise even in hardened environments.
Jun 29, 2026
Security researchers reported multiple **software supply chain** threats targeting developers via public package ecosystems. Tenable analyzed a malicious npm package, **`ambar-src`**, that reached roughly **50,000 downloads** in days before removal; it executed during installation via **malicious `preinstall` behavior**, used evasion techniques, and dropped OS-specific payloads for Windows, Linux, and macOS, with typosquatting assessed as the likely lure (mimicking *`ember-source`*). Separate reporting described a campaign using **malicious NuGet packages** (e.g., **NCryptYo**, **DOMOAuth2_**, **IRAOAuth2.0**, **SimpleWriter_**) that impersonated legitimate .NET libraries, executed code on assembly load, and established local proxying/backdoor behavior to facilitate credential theft and persistence in ASP.NET environments. Additional coverage warned of an npm “worm-like” propagation pattern impacting **CI pipelines and AI coding tools**, reinforcing that developer tooling and build systems are high-risk choke points where a single poisoned dependency can spread quickly across environments. While the broader set of articles also included unrelated breach, ransomware, and policy items, the developer-focused supply chain reporting consistently emphasized that **installation-time execution** and **typosquatting/impersonation** enable compromise even when developers never directly call the malicious code, and that traditional detection can lag (e.g., low initial antivirus detection rates for obfuscated .NET payloads).
Jun 29, 2026