OpenSSF/OSV advisory MAL-2026-7389 confirms this npm version as malicious. Malicious code in reuactjs (npm)
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in reuactjs (npm)
Decision reason
OpenSSF Malicious Packages via OSV confirms reuactjs@8.7.6 as malicious (MAL-2026-7389): Malicious code in reuactjs (npm)