MalwarePublished 27 Jun 2026Updated 8 Jul 2026

react-editable-calendar (npm) · Malicious Code

Affects react-editable-calendarSource GCVE Database

Malicious package : remove react-editable-calendar and rotate any secrets on hosts that installed it.

Data as of 9 Jul 2026, 10:47 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6547

What to do

Remove react-editable-calendar from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmreact-editable-calendar	Affected =0.1.7	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'react-editable-calendar' version 0.1.7 is identified as malicious. It declares a preinstall script pointing to a non-existent file, causing installation failure before any code execution. The package name and documented identity mismatch suggests possible intent to mislead developers. Although the published artifact does not contain exploitable code or network exfiltration capabilities, the package executes commands associated with malicious behavior. No known exploits are reported in the wild.

Impact

Installation of version 0.1.7 of 'react-editable-calendar' will fail due to a missing preinstall script, preventing package code execution. There is no direct harm from the published artifact as it lacks exfiltration or dropper functionality. However, the package's deceptive naming and malicious command execution attempts pose a risk if modified or if other versions are published with active malicious payloads.

Defensive guidance

Users should avoid installing or using this package version. Monitor the npm registry for any updates or advisories from the package maintainer or npm security teams. Since the package fails installation before execution, the immediate risk is limited, but caution is advised due to the malicious classification.

Summary

The 'react-editable-calendar' npm package at version 0.1.7 includes a preinstall hook referencing a script file that is not included in the published package, causing installation to fail with ENOENT error before any code runs. The package's name does not match its documented identity, indicating possible deceptive intent. Despite these suspicious indicators and the package executing commands linked to malicious behavior, the published artifact itself does not contain exfiltration mechanisms or attacker-controlled network destinations. This combination of factors led to its classification as malicious by the OpenSSF Package Analysis project.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 9 Jul 2026, 10:47 UTC

Technical details

References

Community reviews