Backdoored React Native Packages Target Developers with Crypto-Stealing Malware

Aikido researchers disclosed a coordinated supply-chain attack on March 16, 2026 where the publisher “AstrOOnauta” released backdoored updates to react-native-country-select and react-native-international-phone-number; the packages included a malicious preinstall hook that automatically downloads and runs a multi-stage Windows credential and crypto stealer upon npm install, targeting browser wallets, browser profile data, and developer credentials (npm/GitHub), establishing persistence and exfiltrating collected archives.