Malicious code in react-paginate-v5 (npm)

[email protected] is a malicious npm package published as a dependency confusion probe. It exploits the npm install lifecycle by declaring a preinstall script that runs a DNS query to a canary token domain controlled by an attacker or researcher. This DNS query acts as a beacon, confirming installation and leaking resolver metadata to the operator. The package name closely resembles a popular legitimate package (react-paginate) and uses a high version number (99.0.0) to win resolution precedence over internal packages with the same name. Although the current payload only performs a DNS lookup, the install-time execution capability could be used to run arbitrary shell commands. The package itself provides no legitimate functionality.

The primary impact is the exfiltration of installation occurrence and DNS resolver metadata to an attacker-controlled domain, which can reveal internal network information and hosts where the package was installed. While the current payload is limited to a DNS beacon, the underlying mechanism allows execution of arbitrary commands during installation, posing a risk of more severe compromise if exploited with malicious payloads.

No official patch or fix is available as this is a malicious package published to the public npm registry. The best mitigation is to avoid installing packages with suspicious names and implausible version numbers, especially those that resemble internal or popular packages. Implement strict package name allowlisting and verify package provenance before installation. Monitor for unexpected preinstall scripts in dependencies. Since this is not a cloud service, remediation depends on user and organizational controls.