A deeper look into the threat actor behind the react-native-aria attack

This report documents an active supply-chain campaign where a threat actor compromised multiple npm packages and GitHub repositories to distribute a Node.js remote-access trojan. The malware leverages obfuscation, dynamic dependency installation, C2 servers, and a novel blockchain-based staging mechanism (Aptos + BSC) to retrieve and execute hidden payloads; included are deobfuscated code extracts, sandbox findings, and indicators such as package names, blockchain addresses, and a C2 IP.