Malicious code in @emerald-react/avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3683097454908b17afa3726cc9519d1e62c51f5b8932235470cbf0efcfb27099 The package @emerald-react/avatar was found to contain malicious code...

MAL-2026-1598 Malicious code in @emerald-react/avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3683097454908b17afa3726cc9519d1e62c51f5b8932235470cbf0efcfb27099 The package @emerald-react/avatar was found to contain malicious code...

Malicious code in @emerald-react/autocomplete (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3769d592953bbc58c010ccd6832a0c93aa4464e302e8ed7214df4bd5be7c030 The package @emerald-react/autocomplete was found to contain malicious code...

MAL-2026-1597 Malicious code in @emerald-react/autocomplete (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3769d592953bbc58c010ccd6832a0c93aa4464e302e8ed7214df4bd5be7c030 The package @emerald-react/autocomplete was found to contain malicious code...

MAL-2026-1596 Malicious code in @emerald-react/app-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba1bef759f7319b0aca58864ce4ec92e4c9b2ac5a5fc166d8c4b5b755e9e2128 The package @emerald-react/app-header was found to contain malicious code...

Malicious code in @emerald-react/app-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba1bef759f7319b0aca58864ce4ec92e4c9b2ac5a5fc166d8c4b5b755e9e2128 The package @emerald-react/app-header was found to contain malicious code...

Malicious Package

Overview typescript-react-redux-boilerplate is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182RCEExploit REC Exploit is a Python-based secur...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerabilities in js-yaml, minimatch, and react-router

Summary SPSS Collaboration and Deployment Services is affected by vulnerabilities in js-yaml CVE-2025-64718, minimatch CVE-2026-26996, CVE-2026-27903, CVE-2026-27904, react-router CVE-2025-59057, CVE-2025-68470, CVE-2026-21884, CVE-2026-22029, CVE-2026-22030. This has been addressed in the...

Malicious code in @jaime9008/math-service (npm)

Package classified as malware due to code obfuscation, use of eval for code execution, and a low number of published versions. The file lib/lib.js contains same obfuscated malware dropler as malicious react-refresh-update package, the author is same for both pacakge. --- -= Per source details. Do...

MAL-2026-1485 Malicious code in react-refresh-update (npm)

Package contains highly obfuscated code with dynamic execution using eval, a strong indicator of malicious intent. YARA rule matches confirm. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68cf0c0bd6ed2a8c07bc175b5c0cc7f86a49133e67dd5d8f68f37309c5f1a463 The...

Malicious code in react-refresh-update (npm)

Package contains highly obfuscated code with dynamic execution using eval, a strong indicator of malicious intent. YARA rule matches confirm. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68cf0c0bd6ed2a8c07bc175b5c0cc7f86a49133e67dd5d8f68f37309c5f1a463 The...

MAL-2026-1528 Malicious code in react-you-might-not-need-an-effect (npm)

The package 'react-you-might-not-need-an-effect' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 serve...

Malicious code in add-react-displayname (npm)

The package 'add-react-displayname' is part of the PhantomRaven supply chain attack campaign Wave 3. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

MAL-2026-1553 Malicious code in typescript-react-query (npm)

The package 'typescript-react-query' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

MAL-2026-1508 Malicious code in transform-react-jsx (npm)

The package 'transform-react-jsx' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Malicious code in transform-react-jsx (npm)

The package 'transform-react-jsx' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Malicious code in react-you-might-not-need-an-effect (npm)

The package 'react-you-might-not-need-an-effect' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 serve...

MAL-2026-1557 Malicious code in add-react-displayname (npm)

The package 'add-react-displayname' is part of the PhantomRaven supply chain attack campaign Wave 3. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Embedded Malicious Code

Overview react-native-international-phone-number is an International mobile phone input component with mask for React Native Affected versions of this package are vulnerable to Embedded Malicious Code. The publishing pipeline of this package was compromised and a malicious version was released on...