G_Wagon NPM Package Exploits Users to Steal Browser Credentials with Obfuscated Payload

The report documents a sophisticated supply-chain malware campaign in which an npm package named ansi-universal-ui delivers a Python-based infostealer called G_Wagon; the malware evolved across multiple versions to add anti-forensics, memory-only base64 payload execution, a self-dependency double-run trick, and DLL injection, and it targets browsers, over 100 crypto wallet extensions, cloud credentials, SSH/Kubernetes configs, and messaging tokens, exfiltrating compressed data to Appwrite storage buckets—recommended actions include removing the package, rotating passwords and keys, and invalidating sessions.