OpenSSF/OSV advisory MAL-2026-7361 confirms this npm version as malicious. Malicious code in reachtjs (npm)
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in reachtjs (npm)
Decision reason
OpenSSF Malicious Packages via OSV confirms reachtjs@8.7.6 as malicious (MAL-2026-7361): Malicious code in reachtjs (npm)