OpenSSF/OSV advisory MAL-2026-7384 confirms this npm version as malicious. Malicious code in remactjs (npm)
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in remactjs (npm)
Decision reason
OpenSSF Malicious Packages via OSV confirms remactjs@8.7.6 as malicious (MAL-2026-7384): Malicious code in remactjs (npm)