MalwarePublished 10 Jun 2026Updated 15 Jul 2026

yelp-react-component-chaos (npm) · Malicious Code

Affects yelp-react-component-chaosSource GCVE Database

Malicious package : remove yelp-react-component-chaos and rotate any secrets on hosts that installed it.

Data as of 15 Jul 2026, 12:50 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5515

What to do

Remove yelp-react-component-chaos from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmyelp-react-component-chaos	Affected =8.14.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'yelp-react-component-chaos' version 8.14.5 is identified as malicious. During installation, it collects sensitive environment information and credential files from the host and sends this data to an external attacker-controlled server over plain HTTP. The package impersonates Yelp's internal tooling namespace, indicating a dependency confusion attack. Systems with this package installed should be considered fully compromised, and all secrets should be rotated immediately from a clean environment.

Impact

Systems that install this package leak sensitive host and credential information to an attacker-controlled server, potentially exposing secrets such as tokens, passwords, SSH keys, AWS credentials, and other environment secrets. This can lead to unauthorized access, credential theft, and further compromise of the affected environment. The package's presence indicates a dependency confusion attack vector, increasing the risk of supply chain compromise.

Defensive guidance

Remove the 'yelp-react-component-chaos' package version 8.14.5 immediately from all affected systems. Consider all hosts with this package installed as fully compromised. Rotate all secrets and credentials that may have been exposed, including tokens, passwords, SSH keys, AWS credentials, and any other sensitive information, from a separate, clean environment. Due to the potential for persistent compromise, conduct thorough incident response and forensic analysis to identify and remediate any additional malicious artifacts or backdoors. Monitor for any signs of follow-on attacks leveraging stolen credentials.

Summary

The 'yelp-react-component-chaos' npm package at version 8.14.5 performs malicious actions during installation by collecting hostname, username, current working directory, network interfaces, environment variables matching sensitive keywords, and probing for the existence and sizes of critical credential files such as ~/.npmrc, ~/.gitconfig, SSH keys, AWS credentials, and Docker config files. This collected information is exfiltrated via an unencrypted HTTP POST request to a domain associated with malicious activity. The package name is a dependency confusion squat targeting Yelp's private registry namespace, enabling attackers to fingerprint developer or CI hosts and gather credential inventories for targeted follow-on attacks. Due to the nature of the compromise, any system with this package installed should be treated as fully compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 15 Jul 2026, 12:50 UTC

Technical details

References

Community reviews