Malicious code in react-dropzone-v4 (npm)

The 'react-dropzone-v4' package at version 99.0.0 is identified as malicious. Its package.json includes a preinstall lifecycle script that runs automatically on npm install. This script performs an nslookup query and an HTTP GET request to a subdomain of canarytokens.com, sending the hostname of the installing machine to an external server in plaintext. The package name closely resembles the legitimate 'react-dropzone' library and uses an inflated version number to increase the chance of being resolved over an internal package of the same name, a common tactic in dependency confusion attacks. The package does not provide any legitimate functionality and solely acts as an out-of-band beacon to identify hosts that installed it.

The impact is the unauthorized transmission of the installer's hostname to an external third-party domain via DNS and plaintext HTTP during installation. This can lead to information leakage about internal hostnames and potentially aid attackers in reconnaissance or further targeted attacks. No direct code execution or further malicious payloads are described.

No official patch or remediation is indicated. Users should avoid installing the 'react-dropzone-v4' package, especially version 99.0.0, as it is malicious and provides no legitimate functionality. Verify package names carefully to avoid dependency confusion attacks. Use trusted package sources and consider implementing package allowlists or integrity checks to prevent installation of malicious packages.