computerrock-babel-preset-react-app

{"modified":"2026-06-18T15:57:20Z","published":"2026-06-18T15:57:20Z","schema_version":"1.7.4","id":"MAL-2026-6131","summary":"Malicious code in computerrock-babel-preset-react-app (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8987a1638ceebfb3dc8c8fc29e8e696fa15c6fe667697dfc367f59bf56b14cfa)\nThe package impersonates the well-known babel-preset-react-app under a fake org-style prefix and ships no Babel preset code. package.json declares \"preinstall\": \"node index.js\", which runs automatically on npm install. index.js collects hostname, platform, arch, homedir, username/uid/gid/shell, OS info, current working directory, and the output of `whoami` and `id`, then POSTs the JSON payload to a hardcoded https://0bccssrkeubggq24k750nrw0erki88wx.oastify.com/detox56 URL (a Burp Collaborator out-of-band exfiltration host). The package's only function is reconnaissance and exfiltration of installer-side identifiers to an attacker-controlled host.\n","affected":[{"package":{"ecosystem":"npm","name":"computerrock-babel-preset-react-app"},"versions":["15.12.11"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"d3f41fc423c557627870b6d381cd6900ba3f0bf28ee7771b29d3e4bd0eaa39ce","tlsh":"745151c515fa5a241ba7b8494a4f9002a327e1033509ee55bfcc8740af9937c9bf0bf6"},{"path":"package.json","sha256":"83c754ff85d33ba567a06a73a6b1e30bfac9608daad5ba17ed0a7985b3cfcff9","tlsh":"37d02e308e21603369c102974c2a906362e18e2f01047c08e3cf582c818eabb98fe30d"}],"package_integrity":[{"filename":"computerrock-babel-preset-react-app-15.12.11.tgz","hashes":{"sha1":"dc99e8d84c6cd94f8704d30a5268de3ac35421e4","sha512_sri":"sha512-5cslXNRIE7+gJBwf3Oo0pt9XJpr1TK4Gk+bw3dU01c9JEUxuXNfUnHRz6wCdAzMo7iqudFYx43KJjcpCQ23ueQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/computerrock-babel-preset-react-app/v/15.12.11"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-006983","import_time":"2026-06-18T17:08:46.070286157Z","modified_time":"2026-06-18T15:57:20Z","sha256":"8987a1638ceebfb3dc8c8fc29e8e696fa15c6fe667697dfc367f59bf56b14cfa","source":"amazon-inspector","versions":["15.12.11"]}]}}