{"id":"MAL-2026-10207","summary":"Malicious code in react-dom-v17 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f55f6e35ab09a2fcd6521dac51aa4baa4cfa726958bc266a0d56fc14de240a29)\nPackage name impersonates the widely-used `react-dom` package (react-dom-v17). `package.json` declares `preinstall: node index.js`, which fires automatically on `npm install`. The preinstall script (`index.js`) shells out via `child_process.exec` to run `whoami` and `id`, and collects host/user identifiers via `os.hostname()`, `os.userInfo()` (username, uid, gid, shell), `process.platform`, arch, home directory, and cwd. The collected JSON payload is POSTed to a hardcoded Burp Collaborator (oastify.com) subdomain at `https://cjzlyigayl8lknm1sjrppofio9u0is6h.oastify.com/detox56`. The oastify.com host is an attacker-controlled out-of-band callback endpoint used for reconnaissance beacons and confirms exfiltration intent. The preinstall shell execution surface also establishes arbitrary command execution on the installer at install time, enabling follow-on payloads.\n","modified":"2026-07-12T21:01:54.034575617Z","published":"2026-07-12T20:47:33Z","database_specific":{"malicious-packages-origins":[{"versions":["15.0.1"],"id":"IN-MAL-2026-009760","import_time":"2026-07-12T20:48:33.770289829Z","modified_time":"2026-07-12T20:47:33Z","sha256":"f55f6e35ab09a2fcd6521dac51aa4baa4cfa726958bc266a0d56fc14de240a29","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/react-dom-v17/v/15.0.1"}],"affected":[{"package":{"name":"react-dom-v17","ecosystem":"npm","purl":"pkg:npm/react-dom-v17"},"versions":["15.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"bc2b9616e7a9d105b2fa4c7399967570807c12fbc1e7e9ad7cc934a87518998b","tlsh":"a3d0a7304d22553369c502661c3ba44772618f2f14143c08a3cb582c81df37798ff35d"},{"tlsh":"fe5161c505f65a251b67b8494a4f9402b227e0033506de55bfdc8740af9537c9bf0bf2","path":"index.js","sha256":"abee3ce2515771233d85d4a1e3a6c5874cec315a35f880cd39e1a57b999456c0"}],"package_integrity":[{"filename":"react-dom-v17-15.0.1.tgz","hashes":{"sha512_sri":"sha512-/MWCy4RFfdo26vuc1PZJLlhq93QBM/7HgaUIdBIm1WfO1vXLa/FDZzMIHjJFxlvKOrO7kf/ZnX2t8kXOkPVjHw==","sha1":"40891a4170e96cba5fd5cbb9302ce2e1276c2284"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-dom-v17/MAL-2026-10207.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}