OpenSSF/OSV advisory MAL-2026-7447 confirms this npm version as malicious. Malicious code in zreactjs (npm)
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in zreactjs (npm)
Decision reason
OpenSSF Malicious Packages via OSV confirms zreactjs@1.1.4 as malicious (MAL-2026-7447): Malicious code in zreactjs (npm)