registry / react-next-dom / 17.2.8

react-next-dom@17.2.8

This document describes the management of vulnerabilities for the project and all modules within the organization.

AI Security Review

scanned 19d ago · by lpm-firewall-ai

The package contains a runtime remote code execution loader. Calling the exported middleware spawns a detached Node process that downloads JavaScript from jsonkeeper.com and executes it with access to require.

Static reason

One or more suspicious static signals were detected.

Trigger

User/application calls the default exported middleware from index.js.

Impact

Arbitrary remote JavaScript can run in the consumer environment with Node require access; final payload behavior is controlled off-package.

Mechanism

detached child_process plus remote dynamic code execution

Attack narrative

A consumer importing the package and invoking its middleware causes index.js to spawn a detached Node process running lib/caller.js. That script requests https://jsonkeeper.com/b/D3GLF with a secret-like header, reads data.cookie from the response, compiles it with Function.constructor, and invokes it with require. This gives the remote payload arbitrary Node module access outside the audited package source.

Rationale

Source inspection confirms concrete malicious behavior: hidden detached execution of remotely fetched code unrelated to a React/DOM package or normal logger middleware. Lack of install hooks limits trigger scope but does not mitigate the runtime RCE loader.

Evidence

package.jsonindex.jslib/caller.js

Network endpoints2

jsonkeeper.com/b/D3GLFjsonspack.com/issues

OSV Corroboration

react-next-dom masquerades as a React/Next.js ecosystem package but ships a pino-like surface concealing a remote code loader. The main export is a middleware factory that, when invoked, spawns `node./lib/caller.js` as a detached, stdio-ignored child process (`spawn("node", [script,...], { detached: true, stdio: "ignore" }); child.unref()`). lib/caller.js then fetches a JavaScript payload from https://jsonkeeper.com/b/D3GLF (using an `x-secret-key` header), and evaluates the response body in the host Node.js process via `new Function.constructor("require", s)(require)`, retrying up to 5 times. Additional payload URLs (https://jsonkeeper.com/b/XRGF3, https://jsonkeeper.com/b/4NAKK) are hidden as base64 blobs disguised as `DEV_API_KEY` constants in lib/caller.js and lib/const.js. jsonkeeper.com is an anonymous public paste service — content is attacker-mutable, and the executed code runs with full `require` access, giving the operator arbitrary code execution on any host that loads this package's middleware. The package name evokes react/react-dom/next.js while the shipped code impersonates pino (keywords `fast`,`logger`,`stream`,`json`; files `pino.js`, transport, multistream, redaction; `module.exports.pino = middleware`), a typosquat/impersonation cover for the loader. ## Source: ghsa-malware (2a7b3360c09fca3400981d3d0d4c5e8a72c8193e0841c5d2eceb193a08fc440e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

react-next-dom@17.2.8

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code