MAL-2026-6151 Malicious code in buildautomation-touch (npm)

The npm package buildautomation-touch published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

MAL-2026-6181 Malicious code in virtualization-compression-collapse (npm)

The npm package virtualization-compression-collapse published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it...

MAL-2026-6172 Malicious code in platformspecific-webgl (npm)

The npm package platformspecific-webgl published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

MAL-2026-6180 Malicious code in userinterface-machinelearning (npm)

The npm package userinterface-machinelearning published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it...

MAL-2026-6170 Malicious code in onesignal-hooks (npm)

The npm package onesignal-hooks published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

MAL-2026-6150 Malicious code in barcodescanner-reconnect (npm)

The npm package barcodescanner-reconnect published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

MAL-2026-6153 Malicious code in datapersistence-profiling (npm)

The npm package datapersistence-profiling published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

Malicious code in @mastra/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb2d86bcc71a172b3b3abf321bea01e031f13fcbd7cf94c490a5735f02f6dc8f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6056 Malicious code in @mastra/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb2d86bcc71a172b3b3abf321bea01e031f13fcbd7cf94c490a5735f02f6dc8f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5933 Malicious code in react-vite-assert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 746aecfafda9a8f780b53ef40a5697875c52514dfa6ebb29306992ad06128395 [email protected] executes attacker-controlled JavaScript whenever the package is imported. The main entry transitively loads...

MAL-2026-5909 Malicious code in react-hook-use-debounce-throttle-12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0a4d8a0470a3e7fcb2da7cdb29ba6412125924a486aa6f4a437ccfbeb5ca4af package.json declares a postinstall hook that runs node -e to issue an HTTPS request to the bare IP 8.140.205.78 on port 80 with all errors silently...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 — React2Shell Critical pre-authentication Remo...

MAL-2026-5849 Malicious code in vite-configu-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7755490e331340729b0f6eab38cac0857e0aea337579950f610e728b300367fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vite-configu-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7755490e331340729b0f6eab38cac0857e0aea337579950f610e728b300367fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

NPM: React Router: Potential CSRF via PUT/PATCH/DELETE document requests

NPM: React Router: Potential CSRF via PUT/PATCH/DELETE document requests vulnerability discovered by ? in WordPress Npm react-router versions = 7.12.0, 7.15.1...

@aaravpos/appointment-barber-booking (>=1.0.0, <=4.0.5), @aaravpos/appointment-booking-plugin (>=1.0.1, <=7.0.6) +201 more potentially affected by CVE-2026-53663 via react-router (>=7.12.0, <=7.15.0)

react-router NPM version =7.12.0, =1.0.0, =1.0.1, =0.0.9-alpha-20260107202750-16b04dcbaa92c7fc2bbb580dbc1da723c76a5225, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.5.2, =2026.511.1, =1.0.1-MON-198407-add-selinux-sudo-check.0, =0.0.1, =2.0.0-alpha.1 and more Source cves: CVE-2026-53663 Sour...

@aaravpos/appointment-barber-booking (>=1.0.0, <=4.0.5), @aaravpos/appointment-booking-plugin (>=1.0.1, <=7.0.6) +201 more potentially affected by CVE-2026-53663 via react-router (>=7.12.0, <=7.15.0)

react-router NPM version =7.12.0, =1.0.0, =1.0.1, =0.0.9-alpha-20260107202750-16b04dcbaa92c7fc2bbb580dbc1da723c76a5225, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.5.2, =2026.511.1, =1.0.1-MON-198407-add-selinux-sudo-check.0, =0.0.1, =2.0.0-alpha.1 and more Source cves: CVE-2026-53663 Sour...

React Router: Potential CSRF via PUT/PATCH/DELETE document requests

Certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections CORS preflight, SameSite cookies already block the cross-origin attack vectors...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to insufficient CSRF checks for PUT, PATCH, and DELETE document requests. An attacker can cause unauthorized state changes by tricking a user into submitting crafted requests from another origin. Note...

GHSA-84G9-W2XQ-VCV6 React Router: Potential CSRF via PUT/PATCH/DELETE document requests

Certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections CORS preflight, SameSite cookies already block the cross-origin attack vectors...