OpenSSF/OSV advisory MAL-2026-7371 confirms this npm version as malicious. Malicious code in reafctjs (npm)
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in reafctjs (npm)
Decision reason
OpenSSF Malicious Packages via OSV confirms reafctjs@1.1.4 as malicious (MAL-2026-7371): Malicious code in reafctjs (npm)