MalwarePublished 29 Jun 2026Updated 21 Aug 2026

react-wp-viewer (npm) · Malicious Code

Affects react-wp-viewerSource GCVE Database

Malicious package : remove react-wp-viewer and rotate any secrets on hosts that installed it.

Data as of 21 Aug 2026, 16:28 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6571

What to do

Remove react-wp-viewer from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmreact-wp-viewer	Affected =0.2.15 =0.2.4 =0.2.99	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package react-wp-viewer versions 0.2.4, 0.2.15, and 0.2.99 is a dependency-confusion malicious package. Its postinstall script makes an HTTP request to an attacker-controlled IP, leaking environment details such as the installer's IP and hostname. This behavior indicates it is squatting on an internal package name to gather reconnaissance data. The package may lead to full system compromise, and any secrets on affected systems should be rotated immediately.

Impact

The package leaks sensitive environment information to an attacker-controlled server during installation, which can be used for reconnaissance. The malware source warns that systems with this package installed should be considered fully compromised, implying potential unauthorized control and data exposure. Secrets and keys stored on affected systems are at risk and require immediate rotation. The package's presence indicates a successful dependency-confusion attack, which can undermine supply chain security.

Defensive guidance

Users should immediately remove the react-wp-viewer package versions 0.2.4, 0.2.15, and 0.2.99 from their environments. All secrets and keys on affected systems should be rotated from a secure, uncompromised environment. Due to the potential full compromise, a thorough system audit and possible rebuild are recommended. Monitor for any signs of persistent malicious activity beyond the package removal.

Summary

The react-wp-viewer npm package in versions 0.2.4, 0.2.15, and 0.2.99 is identified as a dependency-confusion malicious package. Upon installation, its postinstall hook performs an HTTP GET request to a hardcoded attacker-controlled IP address, transmitting the package name, version, and a fixed nonce. This request leaks the installer's source IP, hostname-derived network position, and confirms the presence of an internal package namespace with the same name. The package self-identifies as a dependency-confusion proof-of-concept and is designed to squat on an internal package name to win resolution against a private package. Although no installer credentials are directly accessed, the callout provides valuable reconnaissance data to attackers. According to a malware source, any system with this package installed or running should be considered fully compromised, and all secrets and keys must be rotated. Removal of the package alone may not eliminate all malicious software introduced.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 21 Aug 2026, 16:28 UTC

Technical details

References

Community reviews