MalwarePublished 13 Jul 2026Updated 1 Sep 2026

@espn-ping/react-dmed-oauth (npm) · Malicious Code

Affects @espn-ping/react-dmed-oauthSource GCVE Database

Malicious package : remove @espn-ping/react-dmed-oauth and rotate any secrets on hosts that installed it.

Data as of 12 Sep 2026, 16:48 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10401

What to do

Remove @espn-ping/react-dmed-oauth from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@espn-ping/react-dmed-oauth	Affected =666.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @espn-ping/react-dmed-oauth version 666.0.0 contains malicious code in its preinstall lifecycle script. This script executes automatically during npm install, collects sensitive environment information including hostname, working directory, username, and public IP, and sends this data covertly to a remote server. The malicious behavior is hidden by suppressing output to the installer's console. This appears to be a dependency-confusion attack targeting an internal ESPN/Disney namespace.

Impact

Sensitive environment information including hostname, username, working directory, and public IP address is exfiltrated to an external attacker-controlled server without user consent or awareness. This can lead to privacy violations and may aid attackers in further targeting or reconnaissance. The malicious code executes automatically during package installation, increasing the risk of compromise in environments that install this package.

Defensive guidance

Users should avoid installing version 666.0.0 of @espn-ping/react-dmed-oauth. Review and remove this package if present in your dependency tree. Monitor for suspicious network traffic to the indicated external domain. Check vendor advisories or npm security notices for updates or removals related to this package.

Summary

The @espn-ping/react-dmed-oauth package at version 666.0.0 declares a preinstall lifecycle script that runs automatically on npm install. The script executes a Node.js file (index.js) which uses child_process.exec to gather the installer's hostname, current working directory, username, and public IP address (via a curl request to ifconfig.me). It then encodes and transmits this data via a curl GET request to a suspicious external URL (https://r.dontvisitmy.website/sendreq.php). The script suppresses output to avoid detection by the user. This behavior is consistent with a dependency-confusion beacon designed to exfiltrate environment information from systems installing this package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Sep 2026, 16:48 UTC

Technical details

References

Community reviews