react-next-dom is a malicious npm package that impersonates React/Next.js ecosystem packages and the pino logging library to conceal a remote code loader. Its main export is middleware that spawns a detached Node.js child process running lib/caller.js, which fetches JavaScript payloads from attacker-controlled URLs on jsonkeeper.com. The payload is executed in the host Node.js process using a dynamic Function constructor with full require access, allowing arbitrary code execution. Additional payload URLs are hidden as base64-encoded constants. Because jsonkeeper.com is an anonymous public paste service, the attacker can modify the payloads at any time, maintaining persistent control over compromised hosts. The package versions =17.2.7, =1.1.7, and =17.2.8 are affected.

Systems that install or run react-next-dom are fully compromised, as the package enables arbitrary remote code execution with full Node.js require privileges. This can lead to complete system takeover, data exfiltration, and unauthorized access to secrets and keys stored on the host. The attacker can modify the remote payloads at any time, maintaining persistent control. Removal of the package alone does not guarantee eradication of all malicious components or backdoors.

Remove the react-next-dom package immediately from all affected systems. Rotate all secrets, keys, and credentials stored on compromised hosts from a separate, secure environment. Because the attacker may have persistent access, conduct a thorough investigation and consider rebuilding affected systems. No official patch or fix is available. Monitor for any suspicious activity related to this package.