OpenSSF/OSV advisory MAL-2026-7430 confirms this npm version as malicious. Malicious code in ureactjs (npm)
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in ureactjs (npm)
Decision reason
OpenSSF Malicious Packages via OSV confirms ureactjs@8.7.6 as malicious (MAL-2026-7430): Malicious code in ureactjs (npm)