MalwarePublished 13 Jul 2026Updated 20 Jul 2026

react-icons-svgo (npm) · Malicious Code

Affects react-icons-svgoSource GCVE Database

Malicious package : remove react-icons-svgo and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10482

What to do

Remove react-icons-svgo from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmreact-icons-svgo	Affected =1.0.0 =1.5.4 =1.5.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The react-icons-svgo npm package contains malicious code that executes a hidden command to install a third-party module at runtime. This module is not declared in dependencies and is controlled by an external publisher, enabling arbitrary remote code execution when the package's SVG-related API is used. The package impersonates popular libraries but provides no legitimate functionality beyond this covert behavior.

Impact

This vulnerability allows an attacker controlling the third-party package rollup-plugin-polyfill-handler to execute arbitrary code on any system that installs and uses the affected react-icons-svgo versions. The code executes with the privileges of the Node.js process, potentially leading to full system compromise or further malicious activity. The malicious package masquerades as a legitimate utility, increasing the risk of inadvertent installation and exploitation.

Defensive guidance

Users should avoid installing or using react-icons-svgo versions 1.0.0, 1.5.3, and 1.5.4. Remove the package from projects and replace it with trusted alternatives. Monitor vendor advisories for updates or official fixes. Since this is a malicious package, consider auditing dependencies for similar typosquatting or impersonation attempts.

Summary

The react-icons-svgo package versions 1.0.0, 1.5.3, and 1.5.4 include base64-encoded literals that decode to a shell command installing the rollup-plugin-polyfill-handler module without saving it to dependencies. Upon invoking advertised API functions related to SVG validation, the package decodes and executes this command silently, then requires and runs the installed module's getPlugin() function. Since the installed package is fully controlled by a third party and not declared in dependencies, this results in arbitrary remote code execution within the Node.js process using react-icons-svgo.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 09:53 UTC

Technical details

References

Community reviews