NPM Supply Chain Attack Compromises 16 Popular React Native and GlueStack Packages (Campaign)

A threat actor compromised 16 widely used React Native and GlueStack packages (collectively downloaded over a million times weekly) by inserting a whitespace-obfuscated remote access trojan (RAT). The malicious payload supports arbitrary command execution, file uploads, data exfiltration, installs dependencies (axios, socket.io-client), implements version-based switching of hardcoded C2 servers, includes new commands (ss_info for system metadata and ss_ip for external IP reporting), and adds persistence mechanisms targeting Windows paths.