Threats Tagged 'mal-2026-10230'

The enbd-react-lib package on npm is a malicious package published to mimic an internal private package naming convention of a target organization, aiming to exploit dependency confusion. It contains a preinstall script that sends telemetry data including the installer's public IP and host environment details to an attacker-controlled Sentry project. The package also silently relays downstream application exceptions and user data to the attacker’s Sentry endpoint if initialized without a custom DSN. This behavior enables reconnaissance and potential compromise of affected systems. The package version 8.0.0 is confirmed malicious. Removal alone may not fully remediate the compromise, and secret rotation is advised.