Malicious code in rceactjs (npm)

The rceactjs package on npm has been identified as containing malicious code in versions 1.1.2, 1.1.4, and 8.7.6. This is classified as a malicious package incident rather than a conventional vulnerability. There is no detailed technical information or vendor advisory available, and no known exploits have been observed in the wild. The lack of patch information suggests users should avoid these versions and consider removing or replacing the package.

Use of the affected versions of the rceactjs package may introduce malicious code into dependent projects, potentially compromising security or integrity. No specific exploitation details or impact scenarios are provided. No known active exploitation has been reported.

Since no official patch or remediation guidance is provided, the recommended action is to avoid using the affected versions (=1.1.2, =1.1.4, =8.7.6) of the rceactjs package. Users should audit their dependencies for this package and remove or replace it with a trusted alternative. Monitor official sources for any future advisories or fixes.