react-native-country-select npm account takeover

Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.

Mapped techniques

T0121 Compromised legitimate artifact
T0109 Publish malicious artifact

supply-chain campaign

T0121 · Resource Development · Compromised legitimate artifact

Published package versions carried the payload.

T0109 · Resource Development · Publish malicious artifact

Named in the tstromberg supplychain-attack-data corpus with first-party references.

Sources

https://www.stepsecurity.io/blog/malicious-npm-releases-found-in-popular-react-native-packages---130k-monthly-downloads-compromised
https://github.com/AstrOOnauta/react-native-country-select/issues/11
https://www.aikido.dev/blog/glassworm-strikes-react-packages-phone-numbers