OpenSSF/OSV advisory MAL-2026-7330 confirms this npm version as malicious. Malicious code in nreactjs (npm)
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in nreactjs (npm)
Decision reason
OpenSSF Malicious Packages via OSV confirms nreactjs@1.1.4 as malicious (MAL-2026-7330): Malicious code in nreactjs (npm)