OpenSSF/OSV advisory MAL-2026-7431 confirms this npm version as malicious. Malicious code in vreactjs (npm)
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in vreactjs (npm)
Decision reason
OpenSSF Malicious Packages via OSV confirms vreactjs@1.1.2 as malicious (MAL-2026-7431): Malicious code in vreactjs (npm)