react-scroll-disable

{"modified":"2026-08-05T09:08:43Z","published":"2026-08-05T09:08:43Z","schema_version":"1.7.4","id":"MAL-2026-12189","summary":"Malicious code in react-scroll-disable (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (30e2eae248242fe92d777348542534e187d7773c2a092e8d3240d8bdd5b94afa)\nOn require of react-scroll-disable, the package's main entry executes an eval(atob(...)) blob appended after the legitimate RemoveScroll export. The blob loads child_process and http via \\uXXXX-escaped identifiers, queries public Ethereum RPCs for the latest transaction to address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the transaction's `to` field into two IPv4 addresses, and issues GET/HEAD requests to those hosts on port 443 (paths /0x/cls and /0x/ls). The response carries an XOR-encrypted second-stage script in an x-payload-b64 header, which is decrypted and executed via spawn('node', ['-e', <payload>], {detached: true, stdio: 'ignore', windowsHide: true}).unref(), producing a detached child process running attacker-controlled code with no user interaction. The same payload is present in both dist/es2015 and dist/es2019 entry files. The attacker rotates the delivery IP by publishing new on-chain transactions, so the fetched code changes without any package update.\n","affected":[{"package":{"ecosystem":"npm","name":"react-scroll-disable"},"versions":["2.5.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/es5/index.js","sha256":"a480bacf385a0ea75fbe615817f3e764e7b55fb25653171aef9f91771ed608a1","tlsh":"05424daa06a27a9bcf0b2673fd97570d237140b266ac2f09311fd875b389c95744e60f"}],"package_integrity":[{"filename":"react-scroll-disable-2.5.2.tgz","hashes":{"sha1":"0feefde36211ea6d62258dc95a147da08e7907d2","sha512_sri":"sha512-AfyYnXHGqjLJMFmHrrq2modTRvpHT34YnQSeF9nihZ9/G1Ay8+/DlCWJEh1IVTUBYvAXeAy+G6vdW8zgogB7cA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/react-scroll-disable/v/2.5.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014564","import_time":"2026-08-05T09:28:26.00658408Z","modified_time":"2026-08-05T09:08:43Z","sha256":"30e2eae248242fe92d777348542534e187d7773c2a092e8d3240d8bdd5b94afa","source":"amazon-inspector","versions":["2.5.2"]}]}}