react-hook-scripts
This report shows the evidence for react-hook-scripts@5.4.2, the only known version.
OpenSSF/OSV Malicious Advisory
imported 4mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-10684 confirms this npm version as malicious.
Advisory
MAL-2026-10684
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in react-hook-scripts (npm)
Details
The package's default export `getPlugin` fetches a JSON document from the hardcoded endpoint https://svganchordev.net/icons/108 and passes the returned `credits` field to `new Function('require','module','exports',...,'Promise', data.credits)`, executing the server-supplied string as JavaScript with full Node.js globals (require, process, Buffer) available. The remote URL is assembled by concatenating protocol/separator/domain/path fragments and the request is framed with an `bearrtoken: "logo"` header and an icon-retrieval path, disguising a remote code loader as an SVG helper despite the package's advertised role as a React/SVG utility. Declared dependencies (@primno/dpapi for Windows DPAPI decryption, better-sqlite3, node-machine-id) are consistent with a credential and host-fingerprint stealer stage delivered by the fetched payload. Any caller of the advertised API triggers execution of arbitrary attacker-controlled code on the installer's host, and the payload can be changed server-side at any time.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
Source confirms a concealed remote payload execution primitive, but the package contains no observed payload and does not invoke it at install or import time. Treat it as a staged payload carrier requiring a warning rather than a confirmed active malicious chain.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
A consumer imports and calls the default export `getPlugin()`.
Impact
The endpoint can supply arbitrary code able to use process and require available local modules.
Mechanism
Fetches and evaluates remotely supplied JavaScript with Node globals.
AI rationale
Source confirms a concealed remote payload execution primitive, but the package contains no observed payload and does not invoke it at install or import time. Treat it as a staged payload carrier requiring a warning rather than a confirmed active malicious chain.
Evidence
package.jsonindex.jsREADME.md
Network endpoints1
svganchordev.net/icons/108
Independent scan evidence
public snapshotAI called this Suspicious at 98.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for AI warning decision
- `index.js` fetches `https://svganchordev.net/icons/108`.
- `index.js` passes response field `data.credits` to `new Function`.
- Remote code receives `require`, `process`, `global`, `Buffer`, and filesystem-relative module resolution.
- `README.md` documents React hooks that `index.js` does not export.
- `package.json` has no lifecycle hooks; remote loader runs only when its default export is called.
Evidence against
- No install, preinstall, postinstall, or prepare script exists in `package.json`.
- No direct credential harvesting, file writes, shell execution, or exfiltration code appears in package source.
- `getPlugin` is exported but not invoked during module initialization.
Behavioral surface
EvalNetwork
Source & flagged code
2 flaggedindex.jsView file
149// Note: The code uses async/await, so we need to handle that
L150: const evalFn = new Function(
L151: 'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise',
High
•matchType = malicious_source_fingerprint_signature
signature = c06bd55d669269cb
signatureType = suspicious_hashes
sourceLabel = OpenSSF malicious-packages
matchedPackage = route-processor@3.1.5
matchedPath = index.js
matchedIdentity = npm:cm91dGUtcHJvY2Vzc29y:3.1.5
similarity = 1.000
shingleOverlap = 1
summary = Malicious code in route-processor (npm)
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
index.jsView on unpkgFindings
2 High1 Medium1 Low
HighEvalindex.js
HighKnown Malware Source Fingerprint Signatureindex.js
MediumNetwork
LowScripts Present
Affected versions and remediation
This report applies to react-hook-scripts@5.4.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing react-hook-scripts@5.4.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.