Malicious code in @tunstock/remact-dom (npm)

The package @tunstock/remact-dom is a malicious typosquat of react-dom that executes a postinstall script upon npm install. This script collects environment details including hostname, platform, architecture, Node.js version, public IP, current working directory, and the consuming project's package.json name and version. It then sends this information via HTTPS POST to a hardcoded, non-affiliated domain (tele.metry.orgin.net) under the path /api/v1/events. The payload misrepresents the package as 'react-dom' version '19.2.0' to disguise the malicious artifact. The author and repository metadata use lookalike names to further obfuscate the source. This behavior constitutes a victim-tagging reconnaissance beacon likely intended to facilitate further supply-chain attacks.

The malicious package exfiltrates sensitive environment and project metadata during installation, potentially exposing internal project details and system identifiers to an attacker-controlled server. This reconnaissance data can be used to target victims for further supply-chain compromises. Although no direct code execution beyond the postinstall script is described, the automatic data exfiltration represents a significant privacy and security risk.

No official patch or remediation is currently documented. Users should avoid installing the @tunstock/remact-dom package and verify package names carefully to prevent typosquatting attacks. Use trusted sources and package integrity verification mechanisms such as npm audit, package signing, or lockfiles. Monitor for suspicious postinstall scripts in dependencies. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.