Malicious code in spark-webpack-react-app (npm)

The package spark-webpack-react-app was found to contain malicious code...

MAL-2025-46117 Malicious code in spark-webpack-react-app (npm)

The package spark-webpack-react-app was found to contain malicious code...

Malicious code in @viihdeonline/react-app (npm)

The package @viihdeonline/react-app was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-9593 Malicious code in @viihdeonline/react-app (npm)

The package @viihdeonline/react-app was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-14091 Malicious code in adform-react-app-core (npm)

The package adform-react-app-core was found to contain malicious code...

Malware in @igain/react-app

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @igain/react-app (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92a7ea271ab926399063ffd4583f6b66fab6f3350920ca611701719de8f9356e Any computer that has this package installed or running should be considered...

MAL-2025-3706 Malicious code in @igain/react-app (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92a7ea271ab926399063ffd4583f6b66fab6f3350920ca611701719de8f9356e Any computer that has this package installed or running should be considered...

Malicious code in bastion-react-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b653fe85132d2b38f6455a8b98a9d59deccd8982eaf7c9e13d97d1037dbc6a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2242 Malicious code in bastion-react-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b653fe85132d2b38f6455a8b98a9d59deccd8982eaf7c9e13d97d1037dbc6a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1525 Malicious code in metamask-sdk-create-react-app (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed98a81fafea025740493667412dfaf8dd28cd12988fabdf1118a1765a12733d Any computer that has this package install...

Malicious code in composed-react-app (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11335 Malicious code in composed-react-app (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in preset-react-app (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2891 Malicious code in preset-react-app (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in ontology-starter-react-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed3602d6737a3861487c258043efce70d2c7fe3708e9dabb0805841c5fddf6d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1801 Malicious code in @plangrid-private/babel-preset-react-app (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2022-5396 Malicious code in polaris-example-create-react-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b09d3e19b74639bb4f35c359140d1a531e719d2e9b76e549ef67c8953446e25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in twilio-video-diagnostics-react-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08e0cb94930e12286826bda59c0308c3cda18c27f2727bff979b6c7d20276278 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

react-dev-utils OS Command Injection in function `getProcessForPort`

react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts in Create React App projects, where the usage is safe. Only when this function is manually invok...