MalwarePublished 22 Apr 2026Updated 29 Jun 2026

@oec-settlement/react-router (npm) · Malicious Code

Affects @oec-settlement/react-routerSource GCVE Database

Malicious package : remove @oec-settlement/react-router and rotate any secrets on hosts that installed it.

Data as of 29 Jun 2026, 22:20 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-2978

What to do

Remove @oec-settlement/react-router from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@oec-settlement/react-router	Affected =99.9.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @oec-settlement/react-router version 99.9.1 contains malicious code that communicates with a domain linked to malicious activity. Any system with this package installed or running should be considered fully compromised. Secrets and keys on affected systems must be rotated immediately from a different, trusted machine. Removing the package alone may not eliminate all malicious software introduced by it.

Impact

Systems with @oec-settlement/react-router version 99.9.1 installed are considered fully compromised. Attackers may have gained control over the system, risking exposure of all stored secrets and keys. The malicious code's communication with a known malicious domain suggests potential data leakage or further compromise. Simply uninstalling the package does not guarantee removal of all malicious components.

Defensive guidance

Immediate removal of the @oec-settlement/react-router package version 99.9.1 is recommended. All secrets, credentials, and keys stored on affected systems should be rotated from a secure, uncompromised environment. Because the system may be fully compromised, consider rebuilding or restoring from a known good backup.

Summary

The package @oec-settlement/react-router version 99.9.1 is identified as malicious due to embedded code that communicates with a domain associated with malicious activity. This behavior indicates potential unauthorized control or data exfiltration risks. The OpenSSF Package Analysis and other sources confirm the malicious nature of this package. The threat affects only the exact version 99.9.1 of this package.

References

github.com/advisories/GHSA-qqc6-xp57-98h7 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Jun 2026, 22:20 UTC

Technical details

References

Community reviews