Security researchers discovered a critical malicious npm package called ansi-universal-ui that deploys the G_Wagon infostealer. The malware uses postinstall hooks to download a Python runtime and execute obfuscated code that steals cryptocurrency wallet data, browser credentials, cloud provider keys (AWS, Azure, GCP), SSH keys, and communication platform tokens. The attack leverages Appwrite cloud infrastructure for command and control, making detection difficult. All versions are affected with a CVSS score of 9.3. Developers should check for the marker file ~/.gwagon_status, remove the package if found, rotate all credentials, and implement protections like disabling lifecycle scripts, using npm ci, and monitoring dependencies with security tools.
Table of contents
What happenedWhat data does G_Wagon steal?Technical analysisIndicators of compromiseThis attack in contextHow to check if you're affectedImmediate remediation stepsProtecting against future attacksDon’t wait for the next attackCompete in Fetch the Flag 2026!28.6K Impressions1 Comment