MalwarePublished 30 Sep 2026

reactjs-risk (npm) · Malicious Code

Affects reactjs-riskSource GCVE Database

Malicious package : remove reactjs-risk and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:27 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17339

What to do

Remove reactjs-risk from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmreactjs-risk	Affected 99.9.9 – 99.17.4 6 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'reactjs-risk' versions 99.17.1 and 99.17.2 contains malicious code that executes during installation. Its preinstall script collects host identity metadata including hostname, username, and platform, encodes this data, and sends it via DNS lookup to a third-party domain without user consent. The package's main entry point is a non-functional stub, indicating the sole purpose is to exfiltrate installer information. This behavior is deliberately obfuscated to evade detection.

Impact

Installing this package results in the unauthorized transmission of the installer's hostname, username, and platform information to a third-party DNS endpoint without user consent. This can lead to privacy violations and potential reconnaissance by malicious actors. There is no indication of further malicious payloads or code execution beyond this data exfiltration.

Defensive guidance

Users should avoid installing the 'reactjs-risk' package versions 99.17.1 and 99.17.2. Verify package authenticity before installation and consider using trusted package registries and tools that detect malicious packages. Monitor for updates from the package maintainer or npm regarding remediation.

Summary

The 'reactjs-risk' npm package (versions 99.17.1 and 99.17.2) includes a preinstall lifecycle script that collects sensitive host metadata such as os.hostname(), the output of the 'whoami' command, and os.platform(). This data is hex-encoded and sent via a DNS A-record lookup to a canarytokens.com subdomain controlled by a third party. The package uses string concatenation to obfuscate the loading of the 'dns' module and the execution of the 'whoami' command. The main entry point of the package is an empty stub, confirming that the package's only functionality is the unauthorized exfiltration of installer identity data during installation.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Sep 2026, 15:54 UTC

Technical details

References

Community reviews