Back Cybersecuritynews

Glassworm Hits Popular React Native Packages With Credential

Cybersecuritynews •Tushar Subhra Dutta • March 17, 2026

A coordinated supply chain attack struck the developer community on March 16, 2026, when a threat actor known as Glassworm backdoored two widely used React Native npm packages, turning them into silent credential and cryptocurrency stealers. The affected packages — [email protected] and [email protected] — were published within minutes of each other by the same publisher, AstrOOnauta, and together accounted […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Glassworm Malware Targets React Native npm Packages in Supply Chain Attack On March 16, 2026, two React Native npm packages, [email protected] and [email protected], were compromised in a supply chain attack attributed to Glassworm malware. The malicious versions included an install-time loader that executes a multi-stage Windows credential and crypto stealer during a routine npm install. The attack affected a significant number of developers, with the compromised packages reporting a combined total of 29,763 downloads in the last week. The malware's install script includes obfuscation and checks for Russian language and timezone signals, indicating a targeted approach. The attack highlights the risks associated with third-party package dependencies in software development. The original versions of the packages do not contain the malicious code, suggesting a specific compromise of the publisher's releases. The situation is ongoing as security professionals assess the impact and potential remediation strategies. 3 sources 75

Extracted Entities

Glassworm Hits Popular React Native Packages With Credential

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Tools (1)