The react-hook-scripts package version 5.4.2 includes a backdoor in its default export 'getPlugin' that fetches a JSON document from a hardcoded remote endpoint. It extracts the 'credits' field from the JSON and executes it as JavaScript code using the Function constructor, providing access to Node.js globals such as require, process, and Buffer. The remote URL is constructed from concatenated fragments and the request includes a custom header to disguise the malicious fetch as an SVG icon retrieval. The fetched payload relies on dependencies like @primno/dpapi, better-sqlite3, and node-machine-id, indicating functionality to steal credentials and host fingerprints. This design allows the attacker to execute arbitrary code on any system that installs and calls the package's API, with the payload modifiable at any time by the attacker.

Any environment that installs and uses react-hook-scripts version 5.4.2 is at risk of arbitrary remote code execution. This can lead to credential theft, host fingerprinting, and potentially full system compromise. The attacker can change the payload at will, enabling ongoing malicious activity. There are no known exploits in the wild at this time, but the risk is significant due to the nature of the code execution and the sensitive data targeted.

No official patch or remediation is currently available for react-hook-scripts version 5.4.2. Users should immediately cease using this package version and remove it from their projects. Avoid installing or running code from this package until a trusted, verified version is released. Monitor vendor advisories for updates. Since this is not a cloud service, remediation depends on user action to remove the malicious package.