react-dom-v17

{"modified":"2026-07-12T20:47:33Z","published":"2026-07-12T20:47:33Z","schema_version":"1.7.4","id":"MAL-2026-10207","summary":"Malicious code in react-dom-v17 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f55f6e35ab09a2fcd6521dac51aa4baa4cfa726958bc266a0d56fc14de240a29)\nPackage name impersonates the widely-used `react-dom` package (react-dom-v17). `package.json` declares `preinstall: node index.js`, which fires automatically on `npm install`. The preinstall script (`index.js`) shells out via `child_process.exec` to run `whoami` and `id`, and collects host/user identifiers via `os.hostname()`, `os.userInfo()` (username, uid, gid, shell), `process.platform`, arch, home directory, and cwd. The collected JSON payload is POSTed to a hardcoded Burp Collaborator (oastify.com) subdomain at `https://cjzlyigayl8lknm1sjrppofio9u0is6h.oastify.com/detox56`. The oastify.com host is an attacker-controlled out-of-band callback endpoint used for reconnaissance beacons and confirms exfiltration intent. The preinstall shell execution surface also establishes arbitrary command execution on the installer at install time, enabling follow-on payloads.\n","affected":[{"package":{"ecosystem":"npm","name":"react-dom-v17"},"versions":["15.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"bc2b9616e7a9d105b2fa4c7399967570807c12fbc1e7e9ad7cc934a87518998b","tlsh":"a3d0a7304d22553369c502661c3ba44772618f2f14143c08a3cb582c81df37798ff35d"},{"path":"index.js","sha256":"abee3ce2515771233d85d4a1e3a6c5874cec315a35f880cd39e1a57b999456c0","tlsh":"fe5161c505f65a251b67b8494a4f9402b227e0033506de55bfdc8740af9537c9bf0bf2"}],"package_integrity":[{"filename":"react-dom-v17-15.0.1.tgz","hashes":{"sha1":"40891a4170e96cba5fd5cbb9302ce2e1276c2284","sha512_sri":"sha512-/MWCy4RFfdo26vuc1PZJLlhq93QBM/7HgaUIdBIm1WfO1vXLa/FDZzMIHjJFxlvKOrO7kf/ZnX2t8kXOkPVjHw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/react-dom-v17/v/15.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-009760","import_time":"2026-07-12T20:48:33.770289829Z","modified_time":"2026-07-12T20:47:33Z","sha256":"f55f6e35ab09a2fcd6521dac51aa4baa4cfa726958bc266a0d56fc14de240a29","source":"amazon-inspector","versions":["15.0.1"]}]}}