react-dom-helpers

{"modified":"2026-08-19T04:45:24Z","published":"2026-08-19T04:45:24Z","schema_version":"1.7.4","id":"MAL-2026-14253","summary":"Malicious code in react-dom-helpers (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2fae606be0dbd7c79552511c2553ec9e1d081df1279f0bc85502a6c08c0f17fb)\nPackage name typosquats `react-dom`. On `require('react-dom-helpers/client')`, client.js decodes a base64-obfuscated Slack bot token and channel ID, enumerates local IPv4 addresses via os.networkInterfaces(), fetches the installer's public IP from api.ipify.org, and POSTs the collected host identifiers to https://slack.com/api/chat.postMessage using the hardcoded bearer token. The exfiltration routine is invoked unconditionally at module load. The base64 wrapping of the Slack credential is used to bypass secret scanners.\n","affected":[{"package":{"ecosystem":"npm","name":"react-dom-helpers"},"versions":["3.3.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"client.js","sha256":"2b4bade75660434352ed0ca2db38e524180b0c204afc68003e4ddb145f2f6845","tlsh":"3b81c89568f214300493b8e95b47f40a7226d1233658df517b8d83b45f8a9bc82db7de"}],"package_integrity":[{"filename":"react-dom-helpers-3.3.3.tgz","hashes":{"sha1":"a6fc987113d6e00d4ba16d0df5d4ffcaab1d2f45","sha512_sri":"sha512-p40Nt7uncRVK4a1vAUsdKemqISx2eEeBk4wpcv/LKXhjAT9HYm9J0eqG95zngimnv/vmW21TFw7uTtteUhGXaQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/react-dom-helpers/v/3.3.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018368","import_time":"2026-08-19T04:47:47.934092824Z","modified_time":"2026-08-19T04:45:24Z","sha256":"2fae606be0dbd7c79552511c2553ec9e1d081df1279f0bc85502a6c08c0f17fb","source":"amazon-inspector","versions":["3.3.3"]}]}}