G_Wagon npm Package Attacking Users to Exfiltrates Browser Credentials using Obfuscated Payload

On January 23rd, 2026, security researchers discovered a dangerous npm package named ansi-universal-ui that disguised itself as a legitimate user interface component library. The deceptive package description claimed to offer a lightweight UI system for modern web applications. However, beneath this innocent facade lay G_Wagon, a highly sophisticated multi-stage information stealer designed to harvest sensitive […]

The post G_Wagon npm Package Attacking Users to Exfiltrates Browser Credentials using Obfuscated Payload appeared first on Cyber Security News.