react-dropzone-v4@99.0.0
Security research - dependency confusion POC
This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe package runs an automatic preinstall callback that discloses the installing host’s hostname to an external tracking endpoint. This establishes a concrete data exfiltration surface and warrants blocking publication.
Decision evidence
public snapshot- The preinstall hook sends the machine hostname to a unique canarytokens domain through DNS lookup, with an HTTP fallback.
- The callback runs automatically during package installation and suppresses errors.
Source & flagged code
4 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe preinstall hook sends the machine hostname to a unique canarytokens domain through DNS lookup, with an HTTP fallback.
package.jsonView on unpkg · L7Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to react-dropzone-v4@99.0.0.
See all versions of react-dropzone-v4 for other recorded verdicts.
- Avoid installing react-dropzone-v4@99.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.