registry / Remote code execution / react-next-vite
react-next-vite
This document describes the management of vulnerabilities for the project and all modules within the organization.
This report shows the evidence for react-next-vite@1.2.9, the only known version.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic source inspection confirms a package main-path loader that downloads and executes remote code in a detached child process; this is concrete malicious behavior even without install hooks. The pino-like surrounding files do not explain or justify the remote Function execution.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Application imports package and invokes the exported middleware/factory function
Impact
Arbitrary remote JavaScript execution in the consuming project environment
Mechanism
detached child process remote payload loader
Attack narrative
The package main entry is not a normal React/Vite module. When its exported middleware factory is called, index.js spawns a detached Node process running lib/caller.js. That child fetches a remote object from a mypinata.cloud IPFS URL, reads data.cookie as code, constructs a Function with require access, and executes it. The child is unrefed with ignored stdio, making the payload run outside the parent request flow.
AI rationale
Static source inspection confirms a package main-path loader that downloads and executes remote code in a detached child process; this is concrete malicious behavior even without install hooks. The pino-like surrounding files do not explain or justify the remote Function execution.
Evidence
package.jsonindex.jslib/caller.jslib/const.jsfile.js
Network endpoints1
bronze-improved-gibbon-411.mypinata.cloud/ipfs/bafkreigjnxn5vnn34rc5r43ajwwkmk4akqpm4awmq5gdhakgszpeqiffsu
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js main exports middleware that spawns detached node process for ./lib/caller.js when invoked
- lib/caller.js fetches code from mypinata.cloud IPFS URL with axios
- lib/caller.js executes fetched response data.cookie via new Function.constructor("require", s)
- Spawned child uses stdio ignore and child.unref(), hiding remote payload execution from caller
- Package is branded as react-next-vite but bundled docs/source mimic pino, with malicious loader added to main path
Evidence against
- package.json has no preinstall/install/postinstall lifecycle hooks
- Remote code is not fetched at mere require-time; exported function must be invoked
- No local credential harvesting code visible before remote payload executes
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
2 flagged · loading sourceindex.jsView file
•matchType = malicious_source_fingerprint_signature
signature = 2ad508fc9ea2882e
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = webpack-patch@1.1.8
matchedPath = index.js
matchedIdentity = npm:d2VicGFjay1wYXRjaA:1.1.8
similarity = 1.000
shingleOverlap = 12
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
index.jsView on unpkgdocs/transports.mdView file
550patternName = generic_password
severity = medium
line = 550
matchedText = password...rd',
Medium
Findings
2 High3 Medium3 Low
HighEval
HighKnown Malware Source Fingerprint Signatureindex.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndocs/transports.md
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to react-next-vite@1.2.9.
The versions list below shows the verdict for each recorded version.
- Avoid installing react-next-vite@1.2.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.