OpenSSF/OSV advisory MAL-2026-7429 confirms this npm version as malicious. Malicious code in treactjs (npm)
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in treactjs (npm)
Decision reason
OpenSSF Malicious Packages via OSV confirms treactjs@8.7.6 as malicious (MAL-2026-7429): Malicious code in treactjs (npm)