The react-dom-helpers package (npm ecosystem) version 3.3.3 is a typosquatting malicious package targeting the legitimate react-dom package name. Its client.js module contains code that decodes a base64-obfuscated Slack bot token and channel ID to bypass secret scanners. It collects local IPv4 addresses via os.networkInterfaces() and fetches the public IP from api.ipify.org. The collected host identifiers are then sent via a POST request to Slack's chat.postMessage API endpoint using the hardcoded bearer token. This data exfiltration routine is triggered automatically upon module load, indicating the package is designed to stealthily collect and leak environment information.

This malicious package compromises the confidentiality of the host environment by exfiltrating network interface details and public IP address to an attacker-controlled Slack channel. This can lead to information leakage about the infected system, potentially aiding further targeted attacks or reconnaissance. There is no indication of direct code execution beyond the exfiltration or other impacts from the provided data.

No official patch or remediation is currently documented for this malicious package. Users should avoid installing react-dom-helpers version 3.3.3 and verify dependencies to prevent typosquatting attacks. Remove any installations of this package immediately. Employ supply chain security measures such as verifying package authenticity and using trusted sources. Monitor for suspicious network activity related to Slack API endpoints. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.