“G_Wagon” Malware Hides in Fake NPM UI Library to Steal Cloud Keys

**Executive Summary:** The report describes discovery of a malicious npm package, ansi-universal-ui, which distributes a sophisticated infostealer called G_Wagon that downloads its own Python runtime, decrypts and injects a Windows DLL into browsers, and exfiltrates browser-stored passwords, crypto wallets, cloud credentials, and Discord tokens to an Appwrite bucket; the actors published 10 versions across two days while rapidly adding C2 and full payload functionality, and the report urges immediate remediation (remove package/node_modules, check for a .agwagon_status file, and rotate credentials).