{"id":"MAL-2026-14484","summary":"Malicious code in react-remove-properties (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ba88629ecae2a180282c29fd385e0bb2067193f01bb3b482b550ae50765d246f)\npackage.json declares the package's own name in both dependencies and devDependencies pointing at http://pack.nppacks.com/npm/react-remove-properties — a plain-HTTP, non-npm-registry, unpinned URL. On `npm install`, npm fetches and installs whatever tarball is served at that mutable third-party endpoint into the installer's node_modules, giving the operator of pack.nppacks.com arbitrary-code delivery into the install. The source is not the official registry, the transport is cleartext HTTP (trivially MITM-able on any network path), the resolution is unpinned (no integrity/hash), and the host is outside npm's audit surface. A header comment in index.js labels the package as 'Security Research Testing Purpose,' but a self-label does not change the delivery mechanism.\n","modified":"2026-08-25T23:50:11.758093197Z","published":"2026-08-25T08:34:38Z","database_specific":{"malicious-packages-origins":[{"sha256":"ba88629ecae2a180282c29fd385e0bb2067193f01bb3b482b550ae50765d246f","source":"amazon-inspector","versions":["6.14.1"],"id":"IN-MAL-2026-018734","import_time":"2026-08-25T08:49:18.160741113Z","modified_time":"2026-08-25T08:34:38Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/react-remove-properties/v/6.14.1"}],"affected":[{"package":{"name":"react-remove-properties","ecosystem":"npm","purl":"pkg:npm/react-remove-properties"},"versions":["6.14.1"],"database_specific":{"indicators":{"package_integrity":[{"filename":"react-remove-properties-6.14.1.tgz","hashes":{"sha1":"e563ec1ca3c3de79cd5e0b89af6db8554c4d6e75","sha512_sri":"sha512-Bd+MwmnX888bdU25llc1wal1recO/hSJk3l5HAklPR7uWWF318I2Lcl9MObgeE/lD1LaX7U672oDXsHa4LN1qw=="}}],"evidence_files":[{"sha256":"2566c9f8f09d5c7e6ad92ce270dfdf70ce2a053cfcf6f06a656eebe98ff85cab","tlsh":"e0f0f404de62ee734ac9216019760803f628794bc028fd5873d7db1c1a8e0ee20f9179","path":"package.json"},{"tlsh":"71a1935ab5e0159745aa22e5b3ce48b577bd80b3330df5a0b54cbf563f40c348a1aed1","path":"index.js","sha256":"f2fcebdb4f0e41365a39ca87a52fcc4e6abd5633fe6272e60d1386d26b90ef41"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-remove-properties/MAL-2026-14484.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}