GlassWorm Hits React Native — Two Popular npm Packages Backdoored with Multi-Stage Credential Stealer via Solana Blockchain C2

{
  "scripts": {
    "preinstall": "node install.js"
  }
}

// Simplified — actual code uses heavy string array shuffling + RC4 obfuscation
const locale = Intl.DateTimeFormat().resolvedOptions().locale;
const timezone = Intl.DateTimeFormat().resolvedOptions().timeZone;

if (locale.startsWith('ru') || timezone.includes('Moscow')) {
    process.exit(0); // Cease execution on Russian systems
}

Solana Blockchain (Immutable Ledger)
        │
        ├── Transaction Memo: "aHR0cHM6Ly80NS4zMi4xNTAuMjUxL3N0YWdlMi..." (base64)
        │                      ↓ decode
        │                      https://45.32.150.251/stage2/payload.enc
        │
        └── The malware reads the latest memo from this wallet
            to get the current C2 URL — rotated daily

Developer runs: npm install
        │
        ▼
package.json → "preinstall": "node install.js"
        │
        ▼
install.js checks system locale
        │
        ├── Russian locale detected → EXIT (kill switch)
        │
        └── Non-Russian locale → Continue
                │
                ▼
        Query Solana blockchain wallet for latest C2 URL
                │
                ▼
        Decode base64 memo → Get encrypted payload URL
                │
                ▼
        Download Stage 2 (decryption keys)
                │
                ▼
        Download Stage 3 (credential stealer)
                │
                ▼
        Persist via Task Scheduler + Registry
                │
                ▼
        Exfiltrate: npm tokens, GitHub tokens, SSH keys,
        crypto wallets, browser data → attacker C2
                │
                ▼
        Stolen credentials used to compromise MORE packages
        (Self-propagating worm behavior)

// What you see in your editor:
const x = "                    ";

// What actually exists (hex):
// 0xFE00 0xFE01 0xFE02 ... (encoded malicious payload)

// What the runtime executes:
eval(decodePUA(x)); // → Full credential stealer

Compromised npm Packages (March 2026):
  - react-native-country-select@0.3.91
  - react-native-international-phone-number@0.11.8

Previously Compromised npm Packages (2025-2026):
  - os-info-checker-es6
  - skip-tot
  - solana-pump-test
  - solana-spl-sdk
  - "@kodane/patch-manager"

Stage 3 Payload Servers:
  - 45.32.150.251
  - 217.69.3.152

Solana C2 Relay IPs (rotated):
  - 45.32.150.97     # Active February 2026
  - 217.69.11.57     # Active February 2026
  - 217.69.11.99     # Active February–March 2026
  - 217.69.0.159     # Active March 13, 2026
  - 45.76.44.240     # Active March 13, 2026

Known Compromised Extensions (with malicious versions):
  - codejoy.codejoy-vscode-extension (v1.8.3, v1.8.4)
  - JScearcy.rust-doc-viewer (v4.2.1)
  - sissel.shopify-liquid (v4.0.1)
  - ginfuru.better-nunjucks (v0.3.2)
  - CodeInKlingon.git-worktree-menu (v1.0.9, v1.0.91)
  - cline-ai-main.cline-ai-agent (v3.1.3)  # Microsoft VSCode Marketplace
  # ... 14+ additional OpenVSX extensions

Windows Persistence:
  - Task Scheduler entry with randomized name executing Node.js binary
  - Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  - Dropped Node.js runtime in %APPDATA% or %TEMP%

macOS Persistence:
  - ~/Library/LaunchAgents/ (plist files with obfuscated names)

# Check if compromised versions are in your project
grep -r "react-native-country-select" package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/null | grep "0.3.91"
grep -r "react-native-international-phone-number" package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/null | grep "0.11.8"

# Check for preinstall hooks in all dependencies (suspicious if unexpected)
find node_modules -name "package.json" -exec grep -l '"preinstall"' {} \;

# Scan for invisible Private Use Area characters (GlassWorm signature)
grep -rP '[\x{FE00}-\x{FE0F}]' --include="*.js" --include="*.ts" .
grep -rP '[\x{E0100}-\x{E01EF}]' --include="*.js" --include="*.ts" .

# Alternative: use file entropy scanning
find . -name "*.js" -exec sh -c '
    entropy=$(cat "$1" | wc -c)
    visible=$(cat "$1" | tr -cd "[:print:]" | wc -c)
    ratio=$(echo "scale=2; $visible/$entropy" | bc 2>/dev/null)
    if [ "$(echo "$ratio < 0.90" | bc 2>/dev/null)" = "1" ]; then
        echo "SUSPICIOUS: $1 (visible ratio: $ratio)"
    fi
' _ {} \;

// Azure Sentinel / Defender XDR — detect outbound connections to known C2 IPs
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in (
    "45.32.150.251", "217.69.3.152",
    "45.32.150.97", "217.69.11.57",
    "217.69.11.99", "217.69.0.159", "45.76.44.240"
)
| project TimeGenerated, DeviceName, InitiatingProcessFileName,
    RemoteIP, RemotePort, RemoteUrl
| order by TimeGenerated desc

// Detect Solana RPC queries from developer workstations (anomalous)
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any ("api.mainnet-beta.solana.com", "solana-api.projectserum.com")
    or RemoteUrl has "solana" and RemotePort == 443
| where InitiatingProcessFileName in~ ("node.exe", "node", "npm", "npx")
| project TimeGenerated, DeviceName, InitiatingProcessFileName,
    RemoteUrl, InitiatingProcessCommandLine

# Check for suspicious Task Scheduler entries
Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -like "*node*" -or
    $_.Actions.Arguments -like "*install*"
} | Select-Object TaskName, TaskPath, State, @{N='Command';E={$_.Actions.Execute + " " + $_.Actions.Arguments}}

# Check for suspicious Run registry entries
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" |
    ForEach-Object { $_.PSObject.Properties | Where-Object { $_.Value -like "*node*" -or $_.Value -like "*appdata*" } }

rule GlassWorm_NPM_Supply_Chain {
    meta:
        description = "Detects GlassWorm supply chain infection indicators in npm packages"
        author = "4nuxd.one"
        date = "2026-03-18"
        reference = "GlassWorm Campaign - React Native npm Backdoor"
    strings:
        // Invisible Unicode PUA characters (GlassWorm signature)
        $unicode1 = { FE 00 }
        $unicode2 = { FE 0F }

        // Solana C2 patterns
        $sol1 = "mainnet-beta.solana.com" ascii
        $sol2 = "getSignaturesForAddress" ascii
        $sol3 = "getTransaction" ascii

        // Google Calendar backup C2
        $gcal1 = "calendar.google.com" ascii
        $gcal2 = "calendar/ical" ascii

        // Preinstall hook abuse
        $hook1 = "\"preinstall\"" ascii
        $hook2 = "install.js" ascii

        // Credential harvesting targets
        $cred1 = ".npmrc" ascii
        $cred2 = "npm_token" ascii nocase
        $cred3 = "GITHUB_TOKEN" ascii
        $cred4 = "gh_token" ascii nocase

        // Known C2 IPs
        $ip1 = "45.32.150.251" ascii
        $ip2 = "217.69.3.152" ascii
        $ip3 = "45.32.150.97" ascii

        // ZOMBI RAT indicators
        $zombi1 = "ZOMBI" ascii
        $zombi2 = "vnc" ascii nocase
        $zombi3 = "socks" ascii nocase

    condition:
        (2 of ($unicode*)) or
        (2 of ($sol*)) or
        ($hook1 and $hook2 and 1 of ($cred*)) or
        (2 of ($ip*)) or
        (1 of ($sol*) and 1 of ($cred*)) or
        ($zombi1 and 1 of ($zombi2, $zombi3))
}

ROTATE IMMEDIATELY:
  npm:
    - Revoke all npm access tokens: https://www.npmjs.com/settings/tokens
    - Generate new tokens with minimal scope
    - Enable npm 2FA if not already active

  GitHub:
    - Revoke all GitHub Personal Access Tokens
    - Revoke all GitHub OAuth app authorizations
    - Review GitHub Actions secrets for any repos you maintain
    - Enable GitHub secret scanning alerts

  SSH:
    - Regenerate all SSH key pairs
    - Remove old public keys from authorized_hosts on all servers

  Cryptocurrency:
    - Transfer ALL funds from any wallet accessible on the compromised machine
    - Generate new wallet addresses from a CLEAN device
    - Revoke any dApp approvals from compromised wallets

  CI/CD:
    - Rotate all CI/CD secrets (GitHub Actions, GitLab CI, CircleCI, etc.)
    - Invalidate all service account tokens
    - Review recent CI/CD runs for unauthorized builds

# Check for the compromised preinstall hook
cat node_modules/react-native-country-select/package.json | grep -A2 preinstall
cat node_modules/react-native-international-phone-number/package.json | grep -A2 preinstall

# Check outbound connections to known C2 infrastructure
# Linux/macOS
netstat -an | grep -E "45\.32\.150\.|217\.69\."
ss -tnp | grep -E "45\.32\.150\.|217\.69\."

# Check for dropped Node.js binaries (persistence mechanism)
find /tmp ~/.local ~/.config -name "node" -type f 2>/dev/null
find "$APPDATA" "$TEMP" -name "node.exe" 2>nul  # Windows

# Pin to known-safe versions
npm install react-native-country-select@0.3.9  # Pre-compromise version
npm install react-native-international-phone-number@0.11.7  # Pre-compromise version

# Use npm audit signatures to verify package integrity
npm audit signatures

# Enable package provenance verification
npm config set //registry.npmjs.org/:enforce-provenance=true

# Ignore all lifecycle scripts during installation
npm config set ignore-scripts true

# Run scripts only after manual review
npm install --ignore-scripts
npm rebuild  # Explicitly run build scripts after audit

# GitHub Actions — enforce frozen lockfile
- name: Install dependencies
  run: npm ci --ignore-scripts
  # npm ci uses package-lock.json exactly, rejecting any modifications

#!/bin/bash
# .git/hooks/pre-commit — detect invisible Unicode injection

if git diff --cached --diff-filter=ACM -z -- '*.js' '*.ts' '*.json' |
   xargs -0 grep -Pn '[\x{FE00}-\x{FE0F}\x{E0100}-\x{E01EF}]' 2>/dev/null; then
    echo "ERROR: Invisible Unicode characters detected — possible GlassWorm injection"
    echo "Review the flagged files before committing"
    exit 1
fi

# Require all packages to have verified provenance (Sigstore-based)
npm config set //registry.npmjs.org/:enforce-provenance=true

# Check provenance status of a specific package
npm audit signatures --package react-native-country-select