Malicious code in rxeactjs (npm)

The rxeactjs package on npm has been identified as containing malicious code in versions 1.1.2, 1.1.4, and 8.7.6. This is classified as a malicious package rather than a traditional software vulnerability. There is no detailed technical description or vendor advisory provided. No known exploits in the wild have been reported. The package is flagged under the MAL-2026-7415 identifier and GHSA-gmwv-hr6q-w545 alias.

The presence of malicious code in these specific versions of the rxeactjs package could lead to compromise of systems that install these versions. However, no specific impact details or exploitation reports are available. The threat is primarily the risk of executing malicious code embedded in the package.

No official patch or remediation guidance is provided. Users should avoid using the affected versions (=1.1.2, =1.1.4, =8.7.6) of the rxeactjs package. Consider removing or replacing this package with a trusted alternative. Monitor for vendor advisories or updates for remediation.