Malicious code in rweactjs (npm)

The rweactjs package on the npm ecosystem has been identified as containing malicious code in specific versions: 1.1.2, 1.1.4, and 8.7.6. This classification is based on the MAL-2026-7414 advisory and the GHSA-crgw-9m6j-5qm7 alias. There is no CVSS score or detailed technical vulnerability description available. No patch or fix information is provided, and the package is not a cloud service. The threat is categorized as a malicious package rather than a software vulnerability.

Users who install or use the affected versions of the rweactjs package may be exposed to malicious code execution risks inherent in the package. The exact impact is not detailed, but malicious packages typically pose risks such as unauthorized code execution, data exfiltration, or supply chain compromise. There are no known active exploits reported.

No official patch or remediation guidance is provided. Users should avoid using the affected versions (=1.1.2, =1.1.4, =8.7.6) of the rweactjs package. It is recommended to verify the integrity and provenance of npm packages before use and consider removing or replacing this package with a trusted alternative. Monitor vendor or ecosystem advisories for updates or fixes.