---
id: 2449
title: "Glassworm Strikes Popular React Native Phone Number Packages"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/glassworm-strikes-react-packages-phone-numbers"
published_at: "2026-03-16 00:00"
tags: ["supply-chain", "malware", "npm", "supply-chain-security", "react-native", "glassworm", "crypto-stealer"]
phying_url: "https://phying.com/item/2449"
lang: en
---

# Glassworm Strikes Popular React Native Phone Number Packages

## Summary

Two React Native packages with ~30,000 combined weekly downloads were backdoored via preinstall hooks fetching a multi-stage Windows crypto and credential stealer. Aikido decrypted the live payload.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2026-03-16 00:00
- **Original:** https://www.aikido.dev/blog/glassworm-strikes-react-packages-phone-numbers
- **Phying News:** https://phying.com/item/2449