MAL-2025-31863 Malicious code in react-vis-showcase (npm)

The package react-vis-showcase was found to contain malicious code...

MAL-2025-13747 Malicious code in @zalastax/nolb-react-rt (npm)

The package @zalastax/nolb-react-rt was found to contain malicious code...

MAL-2025-9266 Malicious code in @react-native-website/lint-examples (npm)

The package @react-native-website/lint-examples was found to contain malicious code...

MAL-2025-31794 Malicious code in react-grid-suite (npm)

The package react-grid-suite was found to contain malicious code...

MAL-2025-31782 Malicious code in react-fatigue-dev-boiler (npm)

The package react-fatigue-dev-boiler was found to contain malicious code...

MAL-2025-38715 Malicious code in vvite-plugin-react-ping (npm)

The package vvite-plugin-react-ping was found to contain malicious code...

MAL-2025-9598 Malicious code in @vpr/react-forms (npm)

The package @vpr/react-forms was found to contain malicious code...

MAL-2025-13652 Malicious code in @zalastax/nolb-react-4 (npm)

The package @zalastax/nolb-react-4 was found to contain malicious code...

MAL-2025-31789 Malicious code in react-focus-lock-next (npm)

The package react-focus-lock-next was found to contain malicious code...

MAL-2025-13738 Malicious code in @zalastax/nolb-react-ri (npm)

The package @zalastax/nolb-react-ri was found to contain malicious code...

MAL-2025-31780 Malicious code in react-dom.js (npm)

The package react-dom.js was found to contain malicious code...

MAL-2025-13818 Malicious code in @zalastax/nolb-react-tw (npm)

The package @zalastax/nolb-react-tw was found to contain malicious code...

MAL-2025-13792 Malicious code in @zalastax/nolb-react-sx (npm)

The package @zalastax/nolb-react-sx was found to contain malicious code...

MAL-2025-6821 Malicious code in @tradair-repo/sources-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4c2e8efcfd67964d523b508359644439a1c57011cf171ba350241c6949654fe4 The OpenSSF Package Analysis project identified '@tradair-repo/sources-react' @ 1.0.0-malicious npm as malicious. It is considered malicious...

CVE-2025-55008

The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router. In versions 0.6.1 and below, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by...

Malicious code in eslint-plugin-react_editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 091ef657bc115b400dc3d8cd65691df53caef85fa307f52d627aac4d50120a77 The OpenSSF Package Analysis project identified 'eslint-plugin-reacteditor' @ 71.71.72 npm as malicious. It is considered malicious because: - T...

MAL-2025-6812 Malicious code in eslint-plugin-react_editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 091ef657bc115b400dc3d8cd65691df53caef85fa307f52d627aac4d50120a77 The OpenSSF Package Analysis project identified 'eslint-plugin-reacteditor' @ 71.71.72 npm as malicious. It is considered malicious because: - T...

CVE-2025-55008

The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router. In versions 0.6.1 and below, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by...

Information Exposure

Overview @workos-inc/authkit-react-router is an Authentication and session helpers for using WorkOS & AuthKit with React Router 7+ Affected versions of this package are vulnerable to Information Exposure via the accessToken and sealedSession parameters in the authkitLoader function. An attacker c...

CVE-2025-55008 AuthKit React Router: Sensitive auth data rendered in HTML

The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router. In versions 0.6.1 and below, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by...