Supply Chain Attack Targets GlueStack and npm Packages, Delivering Malware and Wiper Malware Cybersecurity researchers have uncovered a supply chain attack targeting GlueStack and other npm packages, delivering malware capable of executing shell commands, capturing screenshots, and exfiltrating files. The attack, detected by Aikido Security, affected 13 packages under the `@gluestack-ui` and `@react-native-aria` namespaces, collectively accounting for nearly 1 million weekly downloads. The compromise began on June 6, 2025, when attackers modified the `lib/commonjs/index.js` file in affected versions. The malware, an updated remote access trojan (RAT), includes new commands (`ss_info` and `ss_ip`) to harvest system data and public IP addresses. Researchers noted similarities to a previous attack on the `rand-user-agent` npm package, suggesting the same threat actors may be responsible. The GlueStack maintainers confirmed that a compromised access token belonging to a contributor allowed the malicious updates. While the affected packages have been deprecated, the malware’s persistence mechanism raises concerns, as it could maintain access even after updates. The maintainers have since revoked non-essential contributor access and enforced two-factor authentication (2FA). In a separate discovery, Socket identified two rogue npm packages `express-api-sync` and `system-health-sync-api` designed to wipe application directories. Published under the account `botsailer`, the packages were downloaded 112 and 861 times, respectively, before removal. - `express-api-sync` masquerades as a database sync tool but executes `rm -rf *` upon receiving a hard-coded key (`DEFAULT_123`), deleting all files in the current directory. - `system-health-sync-api` is more sophisticated, acting as both an information stealer and wiper, with OS-specific deletion commands. It exfiltrates data via SMTP email, using hard-coded credentials (`auth@corehomes[.]in`) to send system details to the attacker. Additionally, PyPI saw the emergence of `imad213`, a Python-based credential harvester posing as an Instagram growth tool. Downloaded 3,242 times, the package prompts users for Instagram credentials, which are then sent to 10 third-party bot services. The malware includes a remote kill switch hosted on Netlify, allowing the attacker to disable it remotely. The same threat actor (`IMAD-213`) has uploaded three other malicious packages targeting Facebook, Gmail, Twitter, and VK credentials, as well as a DDoS tool (`poppo213`). These incidents highlight an evolving threat landscape, where attackers are expanding beyond cryptocurrency theft to system sabotage and credential laundering, leveraging supply chain vulnerabilities for broader impact.