@qualys/react-web

{"modified":"2026-02-23T04:21:31Z","published":"2026-02-16T08:50:48Z","schema_version":"1.7.4","id":"MAL-2026-914","summary":"Malicious code in @qualys/react-web (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5c63e27e2c86203c152f6f7bfc30136a44d93bfbc84522fcf86ca97976511a59)\nThe package @qualys/react-web was found to contain malicious code.\n\n## Source: ossf-package-analysis (c34121468e92fda61a11befd4ca6253a635ae9470b89c6ccf4e155c32e9ebc1b)\nThe OpenSSF Package Analysis project identified '@qualys/react-web' @ 5.4.3-2 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"@qualys/react-web"},"versions":["5.4.3-2"]}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]},{"name":"OpenSSF: Package Analysis","type":"FINDER","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"]}],"database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","sha256":"c34121468e92fda61a11befd4ca6253a635ae9470b89c6ccf4e155c32e9ebc1b","import_time":"2026-02-16T09:23:48.846675496Z","modified_time":"2026-02-16T08:50:48Z","versions":["5.4.3-2"]},{"source":"amazon-inspector","sha256":"5c63e27e2c86203c152f6f7bfc30136a44d93bfbc84522fcf86ca97976511a59","import_time":"2026-02-23T04:19:44.604797587Z","modified_time":"2026-02-23T03:51:30Z","versions":["5.4.3-2"]}]}}