G_Wagon NPM Package Exploits Users to Steal Browser Credentials with Obfuscated Payload

Gbhackers •Mayura Kathir • January 27, 2026

GBHackers on Security is a top cybersecurity news platform, delivering up-to-date coverage on breaches, emerging threats, malware, vulnerabilities, and global cyber incidents.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

G_Wagon npm Package Steals Browser Credentials via Obfuscated Payload On January 23, 2026, security researchers identified an npm package named ansi-universal-ui, which masqueraded as a legitimate UI component library. This package contained G_Wagon, a sophisticated multi-stage information stealer designed to exfiltrate sensitive browser credentials from users. The malicious payload was heavily obfuscated to evade detection. 2 sources 36

G_Wagon NPM Package Exploits Users to Steal Browser Credentials with Obfuscated Payload

The full story

Extracted Entities

Attack Types (1)

Malware (1)