G_Wagon NPM Package Exploits Users to Steal Browser Credentials with Obfuscated Payload
## Cybersecurity: Malware Threat in npm Package
Cybersecurity: Malware Threat in npm Package
A sophisticated infostealer malware, disguised as the npm UI component library known as ansi-universal-ui , has been targeting developers. The malware, identified as "G_Wagon," uses multi-stage obfuscation techniques to extract sensitive data such as browser credentials, cryptocurrency wallets, cloud authentication keys, and messaging tokens from infected systems.
Despite its representation as a UI component system for web applications, the package lacks legitimate UI functions. Instead, it delivers a Python-based infostealer, which downloads its runtime environment and executes obfuscated payloads designed to compromise user data.
The package's version history indicates a high level of sophistication and iterative development. In version 1.2.0, the package removed the npm tar dependency, opting to use the system tar command directly. Between Jan 21 and Jan 23, 2026, the threat actor published 10 versions, each improving the attack infrastructure. Initial versions contained placeholder code, while later versions added anti-forensic capabilities, hex-encoded command-and-control URLs, and memory-only payload execution.
Version 1.4.0 introduced advanced evasion techniques by fetching base64-encoded code from remote servers, decoding it in memory, and executing it directly via the Python interpreter. The package also employs a self-dependency trick in its package.json to run the postinstall hook twice, increasing the likelihood of successful compromise. Version 1.3.7 included cleanup code to delete the payload after execution, and log messages were altered to appear legitimate.
A sophisticated infostealer malware, disguised as the npm UI component library known as ansi-universal-ui , has been targeting developers.
The G_Wagon stealer targets a wide range of sensitive information, including credentials from Chrome, Edge, and Brave browsers on Windows and macOS. On Windows, it terminates browser processes and uses Chrome DevTools Protocol to harvest cookies, decrypting saved passwords via the Windows Data Protection API.
The primary objective is cryptocurrency wallet theft. The malware targets over 100 browser wallet extensions, including MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Ledger Live, and Exodus. It copies entire extension data directories for wallets across various blockchain ecosystems like Ethereum, Solana, and Cardano.
Additionally, the malware targets cloud credentials by copying AWS CLI, Azure CLI, and Google Cloud SDK credential files, along with SSH keys and Kubernetes configuration files. It also targets Discord tokens, Telegram data directories, and Steam authentication files.
Stolen data is compressed and uploaded to Appwrite storage buckets hosted on servers in NYC and Frankfurt. For large files, the malware divides data into 5MB pieces for reliable transmission.
Affected users should remove ansi-universal-ui immediately, rotate all browser-saved passwords, revoke cryptocurrency wallet credentials, regenerate cloud service keys, and invalidate messaging application sessions.
Based on reporting by GBHackers.