OpenSSF/OSV advisory MAL-2026-7354 confirms this npm version as malicious. Malicious code in raeactjs (npm)
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in raeactjs (npm)
Decision reason
OpenSSF Malicious Packages via OSV confirms raeactjs@8.7.6 as malicious (MAL-2026-7354): Malicious code in raeactjs (npm)