react-icons-svgo: Malicious npm security report (Block)

OSV Malicious Advisory

scanned 2h ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-10482 confirms this npm version as malicious. index.js stores base64-encoded literals (`svgValidateKey`, `svgValidatePattern`) that decode to the shell command `npm install rollup-plugin-polyfill-handler --no-save --silent --no-audit --no-fund` and to the module name `rollup-plugin-polyfill-handler`...

Advisory

MAL-2026-10482

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in react-icons-svgo (npm)

Details

index.js stores base64-encoded literals (`svgValidateKey`, `svgValidatePattern`) that decode to the shell command `npm install rollup-plugin-polyfill-handler --no-save --silent --no-audit --no-fund` and to the module name `rollup-plugin-polyfill-handler`. When the package's advertised API (`getPlugin`/`setPlugin`, or any SVG validation path via `ValidateSvgModule`/`ValidateSvgModuleB`) is invoked, the code `atob`-decodes those literals, `spawn`s the install command (suppressing output via `--silent --no-audit --no-fund` and skipping persistence via `--no-save`), then `require()`s the decoded module name and immediately invokes its exported `getPlugin()`. The fetched package is undeclared in `dependencies`, its name is hidden behind base64, and its contents are fully controlled by a third-party publisher who can change them at any time — yielding arbitrary remote code execution in the installer's Node process on first use of the advertised SVG utilities. The package name `react-icons-svgo` further impersonates the popular `react-icons` and `svgo` ecosystems while shipping no real functionality beyond a thin CDN helper plus this covert install/require channel.

Decision reason

No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review

References

OSV advisory PACKAGE PACKAGE PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 10.4 KB of source

Source & flagged code

2 flagged

index.jsView file

Lines 1-37javascript

1'use strict';

2

3/**

4 * @file index.js

5 *

6 * Internal SVG processing and CDN helper module.

7 *

8 * Responsibilities:

9 * - Fetch remote resources from CDN providers

10 * - Recursively inspect filesystem entries

11 * - Validate SVG content

12 * - Track execution metrics

13 * - Emit debug information when enabled

14 *

15 */

16

17// Node built-ins for filesystem access and path manipulation.

18const fs = require('fs');

19const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L17

20

21// Third-party HTTP client used to fetch remote resources.

22const req = require("request");

23

24/* -------------------------------------------------------------------------- */

25/* MODULE CONFIGURATION */

26/* -------------------------------------------------------------------------- */

27

28/**

29 * Internal module configuration.

30 */

31const MODULE_CONFIG = {

32 debug: false,

33 version: '1.0.0',

34 encoding: 'utf8',

35 requestTimeout: 5000,

36};

37

•matchType = malicious_source_fingerprint_signature signature = 289d11d48b3841df signatureType = suspicious_hashes sourceLabel = Datadog matchedPackage = react-icon-svgs@2.15.3 matchedPath = index.js matchedIdentity = npm:cmVhY3QtaWNvbi1zdmdz:2.15.3 similarity = 1.000 shingleOverlap = 1 summary = Datadog malicious npm corpus sample: samples/npm/malicious_intent/react-icon-svgs/2.15.3/2026-05-08-react-icon-svgs-v2.15.3.zip

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Source & flagged code

2 flagged · loading source

index.jsView file

•matchType = malicious_source_fingerprint_signature signature = 289d11d48b3841df signatureType = suspicious_hashes sourceLabel = Datadog matchedPackage = react-icon-svgs@2.15.3 matchedPath = index.js matchedIdentity = npm:cmVhY3QtaWNvbi1zdmdz:2.15.3 similarity = 1.000 shingleOverlap = 1 summary = Datadog malicious npm corpus sample: samples/npm/malicious_intent/react-icon-svgs/2.15.3/2026-05-08-react-icon-svgs-v2.15.3.zip

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

17// Node built-ins for filesystem access and path manipulation. L18: const fs = require('fs'); L19: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L17

Findings

1 High2 Medium3 Low

HighKnown Malware Source Fingerprint Signatureindex.js

MediumDynamic Requireindex.js

MediumNetwork

LowScripts Present

LowFilesystem

LowHigh Entropy Strings