Security researchers have uncovered a highly sophisticated infostealer dubbed “G_Wagon” hidden inside a seemingly harmless npm package called ansi-universal-ui.
The package was presented as a modern, lightweight UI component library, but in reality it delivered a multi-stage malware chain designed to loot browser data, crypto wallets, cloud credentials, and messaging tokens.
Boring UI Library With A Dark Secret
The ansi-universal-ui package was described as a modular UI component system for web applications, complete with a polished description, professional-sounding keywords, and a buzzword-heavy README.
None of the advertised UI features actually existed; instead, the package’s sole purpose was to execute a hidden Python-based stealer on victim machines.
The malicious package first drew attention on January 23, 2026, when it was flagged by automated malware detection at 08:46 UTC.
By that time, the attacker had already spent two days iterating through versions, gradually transforming a test harness into a fully weaponized supply-chain attack.
Multi‑Stage Attack Chain With Python Runtime
Under the hood, ansi-universal-ui acts as a Node.js dropper that pulls down its own embedded Python runtime and then executes an obfuscated Python payload.
Early versions contained only a dummy py.py script printing a simple message, allowing the attacker to validate the execution chain before deploying real malicious logic.
To reduce detection, the attacker switched from using npm’s tar library to invoking the system tar command directly, lowering dependency footprint and making the package less suspicious in automated scans.
Once stable, later versions stopped running a local script and instead fetched the live payload from an Appwrite storage bucket, effectively turning the npm package into a remote-controlled loader.
Rapid Versioning Shows Live Weaponization
The version history reads like a live development log of a supply-chain attack. Day one focused on infrastructure testing, adding postinstall hooks, fixing redirect bugs, and ensuring the code could reliably download and extract remote content.
Day two shifted to full weaponization: the attacker introduced command-and-control (C2) URLs, fake branding, self-dependency for double execution, anti-forensics cleanup, and more realistic log messages.
Later versions moved the payload to in-memory execution by fetching base64-encoded Python, decoding it on the fly, and piping it directly into the Python interpreter via stdin, leaving no malicious file on disk.
Additional updates added heavy obfuscation: C2 URLs were split into hex-encoded chunks, variable and directory names were renamed to sound like graphics or layout code, and a decoy “LayoutCompute” class was inserted to mimic a real UI rendering engine.
A final quick-fix release corrected a broken path introduced by these cosmetic changes, showing the attacker actively testing and debugging in real time.
G_Wagon: Browser, Wallet, and Cloud Stealer
Once the Python payload runs, G_Wagon first checks a .gwagon_status file in the user’s home directory to track how many times it has executed, avoiding repeated data theft on the same host.
It then targets major Chromium-based browsers like Chrome, Edge, and Brave on Windows and macOS to harvest cookies and saved passwords.
On Windows, the malware can terminate browser processes, restart them with Chrome DevTools enabled, and dump cookies, while also decrypting stored credentials via the Windows Data Protection API.
On macOS, it extracts encryption keys from the Keychain and uses OpenSSL to decrypt login data from browser databases.
The most damaging capability is its focus on cryptocurrency wallets. G_Wagon scans for more than 100 browser wallet extensions, including MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Ledger Live, Trezor, Exodus, and many others.
It copies entire extension data directories, potentially giving attackers everything they need to hijack assets across Ethereum, Solana, Cosmos, Polkadot, Cardano, TON, Bitcoin Ordinals, and other ecosystems.
Beyond browsers and wallets, the stealer also hunts for cloud and infrastructure credentials.
It targets configuration and credential files for AWS, Azure, and Google Cloud CLIs, SSH keys, and kubeconfig files, effectively turning a single compromised machine into a pivot into full cloud environments.
Discord tokens, Telegram data directories, and Steam authentication files are also collected, enabling account takeovers and further abuse.
Exfiltration, DLL Injection, and What To Do
Stolen data is compressed and uploaded to the attacker’s Appwrite storage buckets, using filenames that encode username, hostname, browser, and profile information.
The malware can chunk and split large archives to ensure reliable uploads, and it maintains both primary and backup C2 endpoints in different regions for resilience.
A particularly advanced feature is an embedded Windows DLL hidden as a large base64- and XOR-encoded blob inside the Python code.
After decryption, the malware injects this DLL into browser processes via low-level NT native APIs such as NtAllocateVirtualMemory, NtWriteVirtualMemory, NtProtectVirtualMemory, and NtCreateThreadEx, then calls an exported Initialize function as the entry point.
Developers who installed ansi-universal-ui should immediately remove the package from their projects and delete the node_modules directory, then assume compromise.
They should rotate all browser-saved passwords, revoke and regenerate any browser-based crypto wallet secrets, rotate cloud provider credentials, regenerate SSH keys, and invalidate Discord and Telegram sessions.
