PT-2026-124591

TuxCare rebuilt @babel/plugin-transform-react-jsx to address 1 CVE. Fixed in 7.29.0-tuxcare.1...

PT-2026-123701

TuxCare rebuilt @babel/plugin-transform-react-jsx to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

PT-2026-124592

TuxCare rebuilt @babel/plugin-transform-react-jsx to address 1 CVE. Fixed in 7.12.18-tuxcare.2...

PT-2026-124349

TuxCare rebuilt @babel/helper-builder-react-jsx-experimental to address 1 CVE. Fixed in 7.11.5-tuxcare.1...

PT-2026-124588

TuxCare rebuilt @babel/plugin-transform-react-jsx to address 1 CVE. Fixed in 7.16.7-tuxcare.1...

Malware in transform-react-jsx

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in transform-react-jsx (npm)

The package 'transform-react-jsx' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

MAL-2026-1508 Malicious code in transform-react-jsx (npm)

The package 'transform-react-jsx' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

MAL-2025-49050 Malicious code in transform-react-jsx-source (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fd1c3c75a248290b6685831711ef1fa1ec32244ea7ab218a36c42a6b5163e560 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview transform-react-jsx-source is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

EUVD-2025-36746

Malicious code in transform-react-jsx-source npm...

Malware in transform-react-jsx-source

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

@tarojs/rn-runner (>=4.0.0-alpha.0, <=4.1.2-alpha.2), @tarojs/rn-style-transformer (>=4.0.0-alpha.0, <=4.1.2-alpha.2) +2 more potentially affected by CVE-2025-5896 via taro-css-to-react-native (>=4.0.0-alpha.0, <=4.1.2-alpha.2)

taro-css-to-react-native NPM version =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.1.2-alpha.2 Source cves: CVE-2025-5896 Source advisory: OSV:GHSA-F5XG-CFPJ-2MW6...

Malicious code in babelpugintransformreactjsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c5382dcc5be3a730f882330e09a06e62a180f32a8cb289d9f1dcd438ca6e2d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1435 Malicious code in babelpugintransformreactjsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c5382dcc5be3a730f882330e09a06e62a180f32a8cb289d9f1dcd438ca6e2d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5373 Malicious code in plugin-transform-react-jsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f27c2a663077678179b48cd4851aa8b5aa144a1d4ef1e3bb2cf05526d0b1c7c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

be-iq_shared-styled-components (0.0.26) potentially affected by unknown CVE via plugin-transform-react-jsx (0.0.1-security)

plugin-transform-react-jsx NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on plugin-transform-react-jsx and may be impacted: - be-iqshared-styled-components 0.0.26 Source cves: unknown CVE Source advisory: GHSA-X743-4V5W-FRPJ...

Malware in plugin-transform-react-jsx

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

be-iq_shared-styled-components (0.0.26) potentially affected by unknown CVE via plugin-transform-react-jsx (0.0.1-security)

plugin-transform-react-jsx NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on plugin-transform-react-jsx and may be impacted: - be-iqshared-styled-components 0.0.26 Source cves: unknown CVE Source advisory: OSV:MAL-2022-5373...