{"id":"MAL-2026-12189","summary":"Malicious code in react-scroll-disable (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (30e2eae248242fe92d777348542534e187d7773c2a092e8d3240d8bdd5b94afa)\nOn require of react-scroll-disable, the package's main entry executes an eval(atob(...)) blob appended after the legitimate RemoveScroll export. The blob loads child_process and http via \\uXXXX-escaped identifiers, queries public Ethereum RPCs for the latest transaction to address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the transaction's `to` field into two IPv4 addresses, and issues GET/HEAD requests to those hosts on port 443 (paths /0x/cls and /0x/ls). The response carries an XOR-encrypted second-stage script in an x-payload-b64 header, which is decrypted and executed via spawn('node', ['-e', \u003cpayload\u003e], {detached: true, stdio: 'ignore', windowsHide: true}).unref(), producing a detached child process running attacker-controlled code with no user interaction. The same payload is present in both dist/es2015 and dist/es2019 entry files. The attacker rotates the delivery IP by publishing new on-chain transactions, so the fetched code changes without any package update.\n","modified":"2026-08-05T10:06:14.225631162Z","published":"2026-08-05T09:08:43Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T09:28:26.00658408Z","modified_time":"2026-08-05T09:08:43Z","sha256":"30e2eae248242fe92d777348542534e187d7773c2a092e8d3240d8bdd5b94afa","source":"amazon-inspector","versions":["2.5.2"],"id":"IN-MAL-2026-014564"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/react-scroll-disable/v/2.5.2"}],"affected":[{"package":{"name":"react-scroll-disable","ecosystem":"npm","purl":"pkg:npm/react-scroll-disable"},"versions":["2.5.2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-scroll-disable/MAL-2026-12189.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"react-scroll-disable-2.5.2.tgz","hashes":{"sha512_sri":"sha512-AfyYnXHGqjLJMFmHrrq2modTRvpHT34YnQSeF9nihZ9/G1Ay8+/DlCWJEh1IVTUBYvAXeAy+G6vdW8zgogB7cA==","sha1":"0feefde36211ea6d62258dc95a147da08e7907d2"}}],"evidence_files":[{"tlsh":"05424daa06a27a9bcf0b2673fd97570d237140b266ac2f09311fd875b389c95744e60f","path":"dist/es5/index.js","sha256":"a480bacf385a0ea75fbe615817f3e764e7b55fb25653171aef9f91771ed608a1"}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}