PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Glassworm Strikes Popular React Native Phone Number Packages

aikido.dev | blog | #supply-chain | #malware | #npm | #supply-chain-security | #react-native | #glassworm | #crypto-stealer
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Two React Native packages with ~30,000 combined weekly downloads were backdoored via preinstall hooks fetching a multi-stage Windows crypto and credential stealer. Aikido decrypted the live payload.
Published
Collected

Related coverage

blog · aikido.dev
LiteLLM compromised again: infostealer and RAT found in version 1.107.0
# LiteLLM compromised again: infostealer and RAT found in version 1.107.0 Written by Ilyas Makari Published on: Oct 21, 2026 On October 21, 2026, version 1.107.0 of LiteLLM (a popular open source...
blog · aikido.dev
tensorlake NPM package compromised with Shai Hulud worm
# tensorlake NPM package compromised with Shai Hulud worm Written by Oliver Smith Published on: Oct 8, 2026 On 8 October 2026 a threat actor published a compromised version of tensorlake to npm....
blog · aikido.dev
Shai-Hulud Rises From the Dead after 111 days
The Shai-Hulud npm worm payload behind May's @AntV attack resurfaced after 111 days: four new packages on September 7 carried the identical hash, despite npm's new publish-time malware scanning.
blog · aikido.dev
Good riddance, TeamPCP. Now for the hard part.
This incident analysis explains systemic gaps in package registry security exposed by recent malicious campaigns.
blog · aikido.dev
Shai-Hulud was the best thing to happen to supply chain security
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · aikido.dev
What is Slopsquatting? The AI Package Hallucination Attack Already Happening
Slopsquatting is typosquatting's AI successor: attackers register package names LLMs hallucinate, waiting for developers to install them on the model's recommendation. It's already happening.
Back