MalwarePublished 10 Jul 2026Updated 13 Jul 2026

eth-react-redirection (npm) · Malicious Code

Affects eth-react-redirectionSource GCVE Database

Malicious package : remove eth-react-redirection and rotate any secrets on hosts that installed it.

Data as of 13 Jul 2026, 09:19 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10127

What to do

Remove eth-react-redirection from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmeth-react-redirection	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cbd414dae34760c2eda09d2093a62a14d694f759350676e88229319a16594e78) On require(), index.js calls callCallerAsOrigin() which spawns lib/caller.js as a detached, stdio-ignored child process (spawn(process.execPath, [script], { detached: true, stdio: 'ignore' }); child.unref()). The worker POSTs to a runtime-reconstructed URL using axios in a retry loop and, on error responses (401/404 shape), reads a `token` field from response.data and passes it to `new module.exports.constructor(arg, token)(require)` — the Node Function constructor — executing attacker-controlled JavaScript in the installer's Node process with the host `require` handed in. lib/caller.js and lib/config.js are wrapped in `Function(name, "...")({...})` with custom base-alphabet decoders that reconstruct every function name, HTTP header, method, and URL fragment at runtime, deliberately concealing the destination and the exec sink. Package metadata is a cover story: package.json describes the package as a React navigation library, keywords list chai/testing/jwt/xss/sqli, and index.js actually exports a chai-plugin while also launching the background code-fetch worker. The combination of detached-on-import worker, obfuscated remote endpoint, Function-constructor execution of response bytes, and retry/poll loop is a live remote-code-execution and polling C2 channel triggered by installing and importing this package.

Impact

Any application or environment that installs and requires eth-react-redirection version 1.0.0 is vulnerable to remote code execution by an attacker controlling the payload URLs. This allows arbitrary JavaScript execution within the context of the Node.js process, potentially leading to full system compromise, data theft, or further malicious activity. The malicious code executes silently and immediately on module load, increasing the risk of unnoticed exploitation.

Defensive guidance

Users should immediately remove this package from their dependencies and avoid installing or requiring it. Since the package fetches payloads over unencrypted HTTP from attacker-controlled endpoints, blocking network access to these URLs can provide temporary mitigation. Monitor dependency sources carefully to avoid installing similarly disguised malicious packages.

Summary

The eth-react-redirection npm package (version 1.0.0) is a malicious package that pretends to be a React navigation library but actually contains injected remote code execution payloads. Its lib/levels.js file includes a top-level immediately-invoked function expression (IIFE) that performs an HTTP GET request to an attacker-controlled URL. If the response is a 404, it extracts a token from the response body and executes it as JavaScript code with the package's require binding, enabling arbitrary code execution. Additionally, it stores a base64-encoded secondary URL used as a backup payload source. The index.js file spawns a detached Node.js child process with ignored stdio and unreferenced handles on every require, further obfuscating malicious activity. This remote-execution occurs immediately upon requiring the package, meaning any consumer of this package is at risk of executing attacker-supplied code.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 11 Jul 2026, 10:11 UTC

Technical details

References

Community reviews