fuel-react

{"modified":"2026-08-21T22:10:33Z","published":"2026-08-21T22:10:33Z","schema_version":"1.7.4","id":"MAL-2026-14355","summary":"Malicious code in fuel-react (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8e35f4772b8cba3555519c250662c67395bf57d89feed3feba7ea067b6bb2c27)\nThe package's postinstall.js script executes automatically on npm install and collects host identity plus environment variables (os.hostname(), process.env) and transmits them via an https request. The package name mimics common React tooling but the shipped install-time behavior is host reconnaissance and environment-variable exfiltration, which frequently captures credentials such as npm tokens, CI secrets, and cloud keys present in process.env.\n","affected":[{"package":{"ecosystem":"npm","name":"fuel-react"},"versions":["91.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"ac5fc56c8ba471dde0d6c9dff5e5ebf315507119166a1edb89b1bba81692f65d","tlsh":"b03185a886f249a223f1528c46872005336dc0237804fd98b94d93981f99bfdc1f36dd"}],"package_integrity":[{"filename":"fuel-react-91.0.0.tgz","hashes":{"sha1":"cc86fe0e31125258856beceea163cf265821fffb","sha512_sri":"sha512-qnETbSIZ8iZNTA9fNpDMkm8ArPBHcrrCJ+vODcpbjsF+38wA0LXKebh75qDFRuLwAKL7Gn5Laka4VPHwbpRXDg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/fuel-react/v/91.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018511","import_time":"2026-08-21T22:42:49.833847742Z","modified_time":"2026-08-21T22:10:33Z","sha256":"8e35f4772b8cba3555519c250662c67395bf57d89feed3feba7ea067b6bb2c27","source":"amazon-inspector","versions":["91.0.0"]}]}}