The NPM ecosystem has been hit by a significant supply chain attack that compromised 17 popular packages from the GlueStack @react-native-aria project. Cybercriminals successfully injected Remote Access Trojan (RAT) malware into these widely-used JavaScript packages, affecting over one million downloads and marking one of the most substantial supply chain compromises of 2025.
Attack Timeline and Discovery
Security researchers at Aikido Security first identified the malicious activity on June 6, 2025, when the initial infected version of the @react-native-aria/focus package was published. The attackers demonstrated sophisticated coordination by rapidly compromising 17 out of 20 packages in the GlueStack ecosystem within a short timeframe.
The discovery came through detection of obfuscated malicious code embedded in the lib/index.js files of affected packages. Given that these compromised packages collectively serve approximately 1.02 million weekly downloads, the potential impact on the global JavaScript development community is substantial.
Technical Analysis of the Malware
The attack employed advanced evasion techniques to avoid detection. Cybercriminals strategically placed the malicious code at the end of source files, preceded by extensive whitespace to conceal its presence during casual inspection on the NPM website. The high level of code obfuscation further complicated detection by automated security systems.
Security analysts have identified striking similarities between this malware and trojans used in previous NPM supply chain attacks, suggesting the involvement of an organized cybercriminal group with established attack methodologies and infrastructure.
RAT Capabilities and System Impact
The embedded RAT malware demonstrates extensive remote control capabilities over infected systems. Once activated, the trojan establishes communication with attacker-controlled command and control servers to receive instructions for various malicious operations on compromised machines.
A particularly dangerous feature involves the malware’s ability to modify the PATH environment variable by inserting a fraudulent path (%LOCALAPPDATA%\Programs\Python\Python3127) at the beginning of the system path. This manipulation allows the malware to intercept Python and pip commands, executing malicious binaries instead of legitimate tools.
Response and Mitigation Efforts
Initial attempts by Aikido Security researchers to contact GlueStack developers through GitHub issues were unsuccessful, highlighting the critical importance of rapid incident response in open-source ecosystems. This delay underscores the need for improved security communication channels within the developer community.
Following notification to NPM administrators and media coverage of the incident, the GlueStack team implemented emergency measures including revoking the compromised access token and marking infected package versions as deprecated. However, complete removal of problematic versions proved impossible due to existing dependencies in other projects.
Connection to Broader Attack Campaign
Cybersecurity experts have linked this incident to the same threat actor group responsible for compromising four other NPM packages: biatec-avm-gas-station, cputil-node, lfwfinance/sdk, and lfwfinance/sdk-dev. This connection indicates a systematic campaign targeting popular JavaScript libraries and suggests ongoing threats to the NPM ecosystem.
The pattern of attacks demonstrates the attackers’ focus on high-impact targets with substantial download volumes, maximizing the potential reach of their malicious payloads across the development community.
This incident emphasizes the critical need for comprehensive software supply chain security measures. Developers must implement regular dependency auditing, deploy automated security monitoring tools, and maintain updated packages from verified sources. Organizations should establish multi-layered defense systems and rapid response procedures to address similar threats. The JavaScript community must prioritize security awareness and implement robust verification processes to prevent future supply chain compromises that could affect millions of applications worldwide.
