{"id":"MAL-2026-17758","summary":"Malicious code in react-dropzone-v4 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (28267e7286151b52836170e94617afcb3c49d17424f7b7ea9fab480c6e008c7c)\nThe package's package.json declares a preinstall lifecycle script that runs automatically on npm install. The script performs an nslookup of $(hostname).hzbvy3cmgred066nig6n3ux0y.canarytokens.com and a curl GET to http://hzbvy3cmgred066nig6n3ux0y.canarytokens.com/$(hostname), causing the installer's hostname to be transmitted to a third-party canarytokens.com subdomain via DNS and plaintext HTTP without consent. The package name mimics the popular react-dropzone library and uses an inflated version number (99.0.0) characteristic of dependency-confusion attacks that aim to win resolution against an internal package of the same name. The package provides no legitimate functionality; its only install-time effect is the out-of-band beacon identifying hosts that resolved and installed it.\n\n## Source: ossf-package-analysis (a198afa2f10e287b1c9d5f196f5ca43288ccf306b9dc753a4d04221c3c91f76b)\nThe OpenSSF Package Analysis project identified 'react-dropzone-v4' @ 99.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2026-10-11T14:30:08.770843165Z","published":"2026-10-11T07:35:19Z","database_specific":{"malicious-packages-origins":[{"versions":["99.0.0"],"import_time":"2026-10-11T07:47:21.562722481Z","modified_time":"2026-10-11T07:35:19Z","sha256":"a198afa2f10e287b1c9d5f196f5ca43288ccf306b9dc753a4d04221c3c91f76b","source":"ossf-package-analysis"},{"import_time":"2026-10-11T14:18:06.491368239Z","modified_time":"2026-10-11T14:00:37Z","sha256":"28267e7286151b52836170e94617afcb3c49d17424f7b7ea9fab480c6e008c7c","source":"amazon-inspector","versions":["99.0.0"],"id":"IN-MAL-2026-021443"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/react-dropzone-v4/v/99.0.0"}],"affected":[{"package":{"name":"react-dropzone-v4","ecosystem":"npm","purl":"pkg:npm/react-dropzone-v4"},"versions":["99.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-dropzone-v4/MAL-2026-17758.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"hashes":{"sha1":"8f40ab77e93bd0bd09f4ba3c1eeeabe4586716c6","sha512_sri":"sha512-6dVvCJ+5a/Y0cB3UDa60vqzjjHQ3qf7JO+edqcAa8ITNouTKZs6/0s16v1yRuJa97bD7zWJt8R1yGJgvwr8k4w=="},"filename":"react-dropzone-v4-99.0.0.tgz"}],"evidence_files":[{"path":"package.json","sha256":"7c43e55749b4cf28c292f65d4733c3187ea95608b27173f331b4cc2638df6ef8","tlsh":"4fe06a340834943719fd8ed11cb0d80b2012dc3740159d8c9a070318654db7345bf698"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}