OpenSSF/OSV advisory MAL-2026-7333 confirms this npm version as malicious. Malicious code in oreactjs (npm)
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in oreactjs (npm)
Decision reason
OpenSSF Malicious Packages via OSV confirms oreactjs@1.1.4 as malicious (MAL-2026-7333): Malicious code in oreactjs (npm)