Malicious code in fuel-react (npm)
The npm package 'fuel-react' version 91.0.0 contains malicious code in its postinstall.js script that executes automatically during installation. This script collects host identity information and environment variables, including sensitive credentials such as npm tokens, CI secrets, and cloud keys, and transmits them via an HTTPS request. The package name mimics legitimate React tooling, potentially deceiving developers into installing it.
AI Analysis
Technical Summary
The 'fuel-react' npm package version 91.0.0 includes a postinstall.js script that runs automatically upon npm install. This script performs host reconnaissance by gathering the hostname and environment variables (process.env), which often contain sensitive credentials. It then exfiltrates this data over HTTPS to an attacker-controlled endpoint. The package masquerades as common React tooling but is designed to steal sensitive information from the host environment during installation.
Potential Impact
Successful installation of this package leads to unauthorized disclosure of sensitive environment variables and host identity information. This can include npm authentication tokens, continuous integration secrets, and cloud service keys, potentially enabling further compromise of developer environments, CI pipelines, and cloud resources.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing the 'fuel-react' package version 91.0.0. Review and remove this package if present, and rotate any potentially exposed credentials such as npm tokens, CI secrets, and cloud keys. Monitor for suspicious activity related to compromised credentials.
Malicious code in fuel-react (npm)
Description
The npm package 'fuel-react' version 91.0.0 contains malicious code in its postinstall.js script that executes automatically during installation. This script collects host identity information and environment variables, including sensitive credentials such as npm tokens, CI secrets, and cloud keys, and transmits them via an HTTPS request. The package name mimics legitimate React tooling, potentially deceiving developers into installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'fuel-react' npm package version 91.0.0 includes a postinstall.js script that runs automatically upon npm install. This script performs host reconnaissance by gathering the hostname and environment variables (process.env), which often contain sensitive credentials. It then exfiltrates this data over HTTPS to an attacker-controlled endpoint. The package masquerades as common React tooling but is designed to steal sensitive information from the host environment during installation.
Potential Impact
Successful installation of this package leads to unauthorized disclosure of sensitive environment variables and host identity information. This can include npm authentication tokens, continuous integration secrets, and cloud service keys, potentially enabling further compromise of developer environments, CI pipelines, and cloud resources.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing the 'fuel-react' package version 91.0.0. Review and remove this package if present, and rotate any potentially exposed credentials such as npm tokens, CI secrets, and cloud keys. Monitor for suspicious activity related to compromised credentials.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14355
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a89a6dbacd9273b49151e5b
Added to database: 08/22/2026, 13:40:43 UTC
Last enriched: 08/22/2026, 13:44:41 UTC
Last updated: 08/23/2026, 00:40:26 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.