MalwarePublished 4 Aug 2026Updated 18 Aug 2026

@ornikar/react-native-svg-transformer (npm) · Malicious Code

Affects @ornikar/react-native-svg-transformerSource GCVE Database

Malicious package : remove @ornikar/react-native-svg-transformer and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-11769

What to do

Remove @ornikar/react-native-svg-transformer from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@ornikar/react-native-svg-transformer	Affected 1.0.6 – 1.0.13 8 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @ornikar/react-native-svg-transformer versions 1.0.6 through 1.0.13 were compromised as part of a large-scale npm supply-chain worm campaign in August 2026. The malicious versions include a preinstall script that downloads and executes an obfuscated payload designed to steal credentials and secrets from the host environment. This payload harvests various cloud and CI/CD credentials and uses stolen npm tokens to propagate further malicious package republishing. Any environment that installed these versions with install scripts enabled should be considered fully compromised and requires immediate credential rotation.

Impact

Installing any affected version with install scripts enabled results in execution of a credential-stealing payload that compromises the host environment. The attacker gains access to a broad set of secrets and tokens, potentially leading to full environment compromise, unauthorized access to cloud and CI/CD infrastructure, and further supply-chain poisoning. The infection spreads by republishing other packages controlled by stolen tokens, amplifying the attack's reach. Systems with this package installed should be treated as fully compromised.

Defensive guidance

The vendor does not provide remediation as this is a malicious republishing event. Immediate actions include removing the affected package versions (1.0.6 through 1.0.13) from all environments, rotating and revoking all credentials and tokens accessible from the compromised systems (including npm, GitHub, cloud provider keys, Vault, Kubernetes, and CI/CD secrets), and treating any environment that installed these versions with install scripts enabled as fully compromised. Credential rotation must be performed from a clean, uncompromised environment. Monitor for any signs of further compromise or unauthorized package publishing.

Summary

The @ornikar/react-native-svg-transformer npm package was trojanized during the 'Shai-Hulud: Here We Go Again' npm worm campaign on August 4, 2026. The compromised versions (1.0.6 to 1.0.13) include a preinstall hook that runs a setup script downloading the Bun runtime and executing a heavily obfuscated ~728 KB Bun-compiled JavaScript payload. This payload steals a wide range of credentials including GitHub, npm, AWS, GCP, Azure, HashiCorp Vault, Kubernetes secrets, and CI/CD tokens. It also enumerates packages accessible by stolen tokens and republishes them with the same malicious hook, enabling rapid self-propagation. The malware exfiltrates stolen data to attacker-controlled GitHub repositories and over DNS. The trojanized package mimics the legitimate package's functionality but adds this malicious chain during installation.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Aug 2026, 16:11 UTC

Technical details

References

Community reviews