react-markdown-canvas

Details

Malicious package due to data exfiltration via Discord webhook on install. Collects IP, hostname, and date without consent.

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (4123db6526d8c37f99fa33e2524edc97922efef6b1605dc0a8acdbf41e76cc77)
The package react-markdown-canvas was found to contain malicious code.

## Source: ossf-package-analysis (833c2865c0a6f984f9af493aa02b5ec03e8a63f037c298a46ae54bb1d88d3a1a)
The OpenSSF Package Analysis project identified 'react-markdown-canvas' @ 1001.0.0 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

Compromised versions (2)

• 1001.0.0
• 1005.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.