OpenSSF/OSV advisory MAL-2026-7364 confirms this npm version as malicious. Malicious code in reacrtjs (npm)
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in reacrtjs (npm)
Decision reason
OpenSSF Malicious Packages via OSV confirms reacrtjs@1.1.2 as malicious (MAL-2026-7364): Malicious code in reacrtjs (npm)