The react-wp-viewer npm package in versions 0.2.4, 0.2.15, and 0.2.99 is identified as a dependency-confusion malicious package. Upon installation, its postinstall hook performs an HTTP GET request to a hardcoded attacker-controlled IP address, transmitting the package name, version, and a fixed nonce. This request leaks the installer's source IP, hostname-derived network position, and confirms the presence of an internal package namespace with the same name. The package self-identifies as a dependency-confusion proof-of-concept and is designed to squat on an internal package name to win resolution against a private package. Although no installer credentials are directly accessed, the callout provides valuable reconnaissance data to attackers. According to a malware source, any system with this package installed or running should be considered fully compromised, and all secrets and keys must be rotated. Removal of the package alone may not eliminate all malicious software introduced.

The package leaks sensitive environment information to an attacker-controlled server during installation, which can be used for reconnaissance. The malware source warns that systems with this package installed should be considered fully compromised, implying potential unauthorized control and data exposure. Secrets and keys stored on affected systems are at risk and require immediate rotation. The package's presence indicates a successful dependency-confusion attack, which can undermine supply chain security.

No official patch or remediation is provided. Users should immediately remove the react-wp-viewer package versions 0.2.4, 0.2.15, and 0.2.99 from their environments. All secrets and keys on affected systems should be rotated from a secure, uncompromised environment. Due to the potential full compromise, a thorough system audit and possible rebuild are recommended. Monitor for any signs of persistent malicious activity beyond the package removal.