G_Wagon npm Package Attacking Users to Exfiltrates Browser Credentials using Obfuscated Payload

Cybersecuritynews •Tushar Subhra Dutta • January 27, 2026

On January 23rd, 2026, security researchers discovered a dangerous npm package named ansi-universal-ui that disguised itself as a legitimate user interface component library. The deceptive package description claimed to offer a lightweight UI system for modern web applications. However, beneath this innocent facade lay G_Wagon, a highly sophisticated multi-stage information stealer designed to harvest sensitive […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

G_Wagon npm Package Steals Browser Credentials via Obfuscated Payload On January 23, 2026, security researchers identified an npm package named ansi-universal-ui, which masqueraded as a legitimate UI component library. This package contained G_Wagon, a sophisticated multi-stage information stealer designed to exfiltrate sensitive browser credentials from users. The malicious payload was heavily obfuscated to evade detection. 2 sources 36

Extracted Entities

G_Wagon npm Package Attacking Users to Exfiltrates Browser Credentials using Obfuscated Payload

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Tools (1)