react-v17@20.0.1: Malicious npm security report (Block)

OSV Malicious Advisory

scanned 13d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-7020 confirms this npm version as malicious. Package name 'react-v17' impersonates the legitimate 'react' package. package.json declares a preinstall hook 'node index.js' that auto-executes on npm install. index.js collects installer identity and host details (os.hostname(), os.userInfo(), os.platform/arch, home directory, cwd) and runs 'whoami' and 'id' via child_process.exec, then HTTPS POSTs the aggregate JSON to a hardcoded Burp Collaborator OOB endpoint...

Advisory

MAL-2026-7020

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in react-v17 (npm)

Details

Package name 'react-v17' impersonates the legitimate 'react' package. package.json declares a preinstall hook 'node index.js' that auto-executes on npm install. index.js collects installer identity and host details (os.hostname(), os.userInfo(), os.platform/arch, home directory, cwd) and runs 'whoami' and 'id' via child_process.exec, then HTTPS POSTs the aggregate JSON to a hardcoded Burp Collaborator OOB endpoint at https://1jlay7gzya8akcmqs8repdf7oyupim6b.oastify.com/detox56. The tarball also ships an undeclared ~10.9 KB file 'i' next to index.js that is not referenced by package.json or index.js.

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 2.94 KB of source, external domains: 1jlay7gzya8akcmqs8repdf7oyupim6b.oastify.com

Source & flagged code

2 flagged

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

1const { exec } = require('child_process'); L2: const os = require('os'); L3: const https = require('https'); L4: const http = require('http'); ... L12: return new Promise((resolve, reject) => { L13: exec(command, (error, stdout, stderr) => { L14: if (error) { ... L30: pwd: '', L31: hostname: os.hostname(), L32: platform: os.platform(), ... L96: if (res.statusCode >= 200 && res.statusCode < 300) { L97: resolve({ statusCode: res.statusCode, body: responseData });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L1

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

1const { exec } = require('child_process'); L2: const os = require('os'); L3: const https = require('https'); L4: const http = require('http'); ... L12: return new Promise((resolve, reject) => { L13: exec(command, (error, stdout, stderr) => { L14: if (error) { ... L30: pwd: '', L31: hostname: os.hostname(), L32: platform: os.platform(), ... L96: if (res.statusCode >= 200 && res.statusCode < 300) { L97: resolve({ statusCode: res.statusCode, body: responseData });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L1

Findings

2 High2 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilityindex.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings