Supply Chain Attack Targets GlueStack and npm Packages, Delivering Malware and Wiper Malware
Cybersecurity researchers have uncovered a supply chain attack targeting GlueStack and other npm packages, delivering malware capable of executing shell commands, capturing screenshots, and exfiltrating files. The attack, detected by Aikido Security, affected 13 packages under the @gluestack-ui and @react-native-aria namespaces, collectively accounting for nearly 1 million weekly downloads.
The compromise began on June 6, 2025, when attackers modified the lib/commonjs/index.js file in affected versions. The malware, an updated remote access trojan (RAT), includes new commands (ss_info and ss_ip) to harvest system data and public IP addresses. Researchers noted similarities to a previous attack on the rand-user-agent npm package, suggesting the same threat actors may be responsible.
The GlueStack maintainers confirmed that a compromised access token belonging to a contributor allowed the malicious updates. While the affected packages have been deprecated, the malware’s persistence mechanism raises concerns, as it could maintain access even after updates. The maintainers have since revoked non-essential contributor access and enforced two-factor authentication (2FA).
In a separate discovery, Socket identified two rogue npm packages express-api-sync and system-health-sync-api designed to wipe application directories. Published under the account botsailer, the packages were downloaded 112 and 861 times, respectively, before removal.
express-api-syncmasquerades as a database sync tool but executesrm -rf *upon receiving a hard-coded key (DEFAULT_123), deleting all files in the current directory.system-health-sync-apiis more sophisticated, acting as both an information stealer and wiper, with OS-specific deletion commands. It exfiltrates data via SMTP email, using hard-coded credentials (auth@corehomes[.]in) to send system details to the attacker.
Additionally, PyPI saw the emergence of imad213, a Python-based credential harvester posing as an Instagram growth tool. Downloaded 3,242 times, the package prompts users for Instagram credentials, which are then sent to 10 third-party bot services. The malware includes a remote kill switch hosted on Netlify, allowing the attacker to disable it remotely. The same threat actor (IMAD-213) has uploaded three other malicious packages targeting Facebook, Gmail, Twitter, and VK credentials, as well as a DDoS tool (poppo213).
These incidents highlight an evolving threat landscape, where attackers are expanding beyond cryptocurrency theft to system sabotage and credential laundering, leveraging supply chain vulnerabilities for broader impact.
Source: https://thehackernews.com/2025/06/new-supply-chain-malware-operation-hits.html
npm, Inc. cybersecurity rating report: https://www.rankiteo.com/company/npm-inc-
gluestack cybersecurity rating report: https://www.rankiteo.com/company/gluestackio
"id": "NPMGLU1778552678",
"linkid": "npm-inc-, gluestackio",
"type": "Cyber Attack",
"date": "6/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Nearly 1 million weekly '
'downloads',
'industry': 'Technology',
'name': 'GlueStack',
'type': 'Software Development'},
{'customers_affected': '13 packages affected',
'industry': 'Technology',
'name': 'npm',
'type': 'Package Registry'},
{'customers_affected': '3,242+ downloads of malicious '
'packages',
'industry': 'Technology',
'name': 'PyPI',
'type': 'Package Registry'}],
'attack_vector': ['Compromised npm packages',
'Malicious PyPI packages',
'Compromised access token'],
'data_breach': {'data_exfiltration': ['Yes (via SMTP email, remote access '
'trojan)'],
'personally_identifiable_information': ['Instagram, Facebook, '
'Gmail, Twitter, VK '
'credentials'],
'sensitivity_of_data': ['High (credentials, system '
'information)'],
'type_of_data_compromised': ['System data',
'Public IP addresses',
'Social media credentials']},
'date_detected': '2025-06-06',
'description': 'Cybersecurity researchers uncovered a supply chain attack '
'targeting GlueStack and other npm packages, delivering '
'malware capable of executing shell commands, capturing '
'screenshots, and exfiltrating files. The attack affected 13 '
'packages under the @gluestack-ui and @react-native-aria '
'namespaces, with nearly 1 million weekly downloads. '
'Additionally, rogue npm packages were found delivering wiper '
'malware to wipe application directories, and a Python-based '
'credential harvester was discovered on PyPI.',
'impact': {'brand_reputation_impact': ['GlueStack', 'npm', 'PyPI'],
'data_compromised': ['System data',
'Public IP addresses',
'Instagram credentials',
'Facebook/Gmail/Twitter/VK credentials'],
'identity_theft_risk': ['High (due to credential harvesting)'],
'operational_impact': ['Potential data loss due to wiper malware',
'Unauthorized access to systems'],
'systems_affected': ['npm packages (@gluestack-ui, '
'@react-native-aria)',
'PyPI packages (imad213, poppo213)']},
'initial_access_broker': {'backdoors_established': ['Remote access trojan '
'(RAT)'],
'entry_point': ['Compromised npm packages',
'Malicious PyPI packages']},
'investigation_status': 'Ongoing',
'lessons_learned': 'The incident highlights the risks of supply chain '
'attacks, the importance of securing contributor access, '
'and the need for enhanced monitoring of package '
'registries.',
'motivation': ['Data exfiltration',
'System sabotage',
'Credential theft',
'Financial gain'],
'post_incident_analysis': {'corrective_actions': ['Revocation of '
'non-essential contributor '
'access',
'Enforcement of 2FA',
'Deprecation of affected '
'packages'],
'root_causes': ['Compromised access token',
'Insufficient access controls',
'Lack of 2FA enforcement']},
'recommendations': ['Enforce two-factor authentication (2FA) for all '
'contributors',
'Regularly audit access tokens and permissions',
'Monitor package registries for suspicious activity',
'Educate users on the risks of installing unverified '
'packages'],
'references': [{'source': 'Aikido Security'}, {'source': 'Socket'}],
'response': {'containment_measures': ['Deprecation of affected packages',
'Revocation of non-essential '
'contributor access'],
'remediation_measures': ['Enforcement of two-factor '
'authentication (2FA)'],
'third_party_assistance': ['Aikido Security', 'Socket']},
'title': 'Supply Chain Attack Targets GlueStack and npm Packages, Delivering '
'Malware and Wiper Malware',
'type': ['Supply Chain Attack',
'Malware Distribution',
'Wiper Malware',
'Credential Harvesting'],
'vulnerability_exploited': ['Supply chain compromise',
'Insufficient access controls',
'Lack of two-factor authentication (2FA)']}