react-paginate-v5

GHSA-fg5r-8pv8-mvc8

Malicious code in react-paginate-v5 (npm)

Details

**Severity:** Critical

**Affected versions:** `= 99.0.0`

## Source: amazon-inspector (2c0f91fe35323a6f47033b90ebaf88498a36fd7e8e933711b2cf301dba2e4759)
[email protected] is a dependency-confusion probe published under a name resembling the popular react-paginate package and pinned to an implausibly high version (99.0.0) to win resolution against an internal package. Its package.json declares a preinstall lifecycle script that runs `nslookup dep-confusion-poc.2chsn9exkdupkr3cxed7vp7sk.canarytokens.com`, which fires automatically on `npm install` and emits a DNS query from the installer's resolver to an attacker/researcher-controlled canary subdomain. The subdomain label (`dep-confusion-poc`) self-identifies the operation as a dependency-confusion test. The DNS lookup confirms successful installation to the operator of the canary token, identifying hosts and networks where an internal package name was shadowed by this public squat. While the beacon itself only exfiltrates the fact of installation plus resolver metadata, the same install-time execution primitive can carry any shell command, and the package has no legitimate functionality.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/npm/react-paginate-v5/MAL-2026-17777.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/npm/react-paginate-v5/MAL-2026-17777.json
- https://www.npmjs.com/package/react-paginate-v5/v/99.0.0
- https://github.com/advisories/GHSA-fg5r-8pv8-mvc8

Compromised versions (1)

= 99.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.