registry / react-scroll-disable / 2.5.2

react-scroll-disable@2.5.2

Disables scroll outside of `children` node.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Importing any published CommonJS or ESM entrypoint activates an obfuscated remote loader. It retrieves staged instructions through Ethereum data and executes downloaded code in the host Node process or a detached child.

Static reason

No blocking static signals were detected.

Trigger

Application build, server, or tooling imports react-scroll-disable.

Impact

Arbitrary attacker-controlled code execution and persistence outside the intended scroll-control functionality.

Mechanism

Obfuscated blockchain-addressed remote payload loader with eval and detached child-process execution.

Attack narrative

Each public entrypoint appends a Base64-obfuscated immediate async loader. It contacts configured/public Ethereum RPC services, locates transaction data, derives further hosts, retrieves an encoded payload, and executes it via eval or a detached `node -e` process. This is unrelated to the advertised React scroll utility and runs solely on import.

Rationale

Confirmed import-time staged remote code execution in all published entrypoints. The absence of install hooks does not mitigate the concrete runtime execution chain.

Evidence

package.jsondist/es5/index.jsdist/es2015/index.jsdist/es2019/index.js

Network endpoints2

eth.blockscout.com/apieth-mainnet.public.blastapi.io

react-scroll-disable@2.5.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code