Back Gbhackers

Glassworm Malware Infects Popular React Native npm Packages

Gbhackers •Mayura Kathir • March 17, 2026

A new Glassworm-linked supply chain attack has briefly turned two popular React Native npm packages into delivery vehicles for Windows credential-stealing malware. On March 16, 2026, malicious versions of AstrOOnauta’s [email protected] and [email protected] were published to npm, each embedding an identical staged loader that executes during a routine npm install. Together, these packages account for […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Glassworm Malware Targets React Native npm Packages in Supply Chain Attack On March 16, 2026, two React Native npm packages, [email protected] and [email protected], were compromised in a supply chain attack attributed to Glassworm malware. The malicious versions included an install-time loader that executes a multi-stage Windows credential and crypto stealer during a routine npm install. The attack affected a significant number of developers, with the compromised packages reporting a combined total of 29,763 downloads in the last week. The malware's install script includes obfuscation and checks for Russian language and timezone signals, indicating a targeted approach. The attack highlights the risks associated with third-party package dependencies in software development. The original versions of the packages do not contain the malicious code, suggesting a specific compromise of the publisher's releases. The situation is ongoing as security professionals assess the impact and potential remediation strategies. 3 sources 75

Extracted Entities

Glassworm Malware Infects Popular React Native npm Packages

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (3)

Platforms (1)