Glassworm Hits Popular React Native Packages With Credential-Stealing npm Malware

Cybersecurity Incident: Credential-Stealing Malware in React Native Packages

On Mon, Mar 16, 2026, a supply chain attack affected the developer community when a threat actor identified as Glassworm compromised two popular React Native npm packages to deploy credentials and cryptocurrency-stealing malware.

react-native-country-select@0.3.91 react-native-international-phone-number@0.11.8

These packages, essential for mobile UI functionality such as phone number input and country selection, were downloaded over 134,887 times the month before the attack. The malicious versions were uploaded by the publisher AstrOOnauta.

The attack did not require any special actions from users. Running a standard npm install command initiated the malware, which introduced a preinstall hook that executed an obfuscated JavaScript file named install.js . This file facilitated the deployment of a multi-stage Windows payload.

The infection maintained invisibility as it appeared to be a routine package update. Developers had no immediate indication of the malicious activity.

Researchers identified the compromised packages and traced the malware's execution chain. The identical loader file in both packages shared a SHA-256 hash, indicating a deliberate modification. The malicious behavior was introduced via a new install.js file and a preinstall entry in package.json .

During the attack week, the packages accumulated 29,763 downloads. Previous clean versions were published on Fri, Mar 13, 2026. Developers using these packages, either directly or as dependencies, were at risk.

Audit lock files for the compromised versions. Consider machines with these versions installed compromised. Rotate all npm tokens, GitHub credentials, and cryptocurrency wallet keys accessible on affected systems. Review network logs for connections to 45.32.150.251 and 217.69.3.152 . Audit package lifecycle scripts and flag unexpected preinstall hooks.

This incident highlights the importance of monitoring package updates and maintaining robust security protocols to mitigate risks from supply chain attacks.

Based on reporting by Cyber Security News.