GlassWorm Supply-Chain Campaign Compromises Open-Source Packages, Repositories, and Extensions

GlassWorm conducted a renewed software supply-chain campaign that compromised open-source components across GitHub, npm, VSCode, and OpenVSX, with researchers attributing at least 433 malicious repositories, packages, and extensions to the operation. Reporting from multiple security firms linked the activity through shared infrastructure, similar payloads, and the same Solana blockchain address used for command-and-control. The campaign reportedly began with compromised GitHub accounts and force-pushed malicious commits, then expanded into published npm packages and editor extensions containing obfuscated code designed to evade review and steal developer credentials, cryptocurrency wallet data, and other sensitive information.

One documented part of the campaign involved the backdooring of the npm packages react-native-country-select@0.3.91 and react-native-international-phone-number@0.11.8, both published by AstrOOnauta and together downloaded more than 134,000 times in the prior month. Aikido found both packages used a new preinstall hook to execute an obfuscated install.js loader during a routine npm install, allowing infection of developer workstations, CI runners, and build agents without additional user action. Researchers said the loader was byte-identical in both packages, indicating deliberate tampering rather than a build error, and placed the incident within GlassWorm's broader pattern of using stealthy package modifications and cross-platform malware delivery to target the software development ecosystem.