Malicious code in react-remove-properties (npm)

The react-remove-properties package version 6.14.1 contains a malicious code delivery mechanism due to its package.json declaring dependencies from an untrusted HTTP URL (http://pack.nppacks.com/npm/react-remove-properties) outside the official npm registry. This URL is unpinned and uses cleartext HTTP, making it trivially susceptible to man-in-the-middle attacks and arbitrary code injection during installation. The package's own name is declared in both dependencies and devDependencies, causing npm to fetch and install code from this mutable third-party source. Although the code includes a comment indicating 'Security Research Testing Purpose,' this does not change the insecure delivery mechanism or the risk of arbitrary code execution.

An attacker controlling the third-party endpoint (pack.nppacks.com) or able to intercept network traffic can deliver arbitrary code to users installing react-remove-properties version 6.14.1. This can lead to arbitrary code execution on the system performing the npm install, potentially compromising the build environment or developer machines.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or updated package is available, users should avoid installing react-remove-properties version 6.14.1 or any versions that rely on dependencies fetched from untrusted HTTP sources. Use packages only from the official npm registry with pinned versions and integrity hashes to prevent arbitrary code delivery.