Malicious Code Vulnerability in react-dropzone-v4: A Threat to User Privacy
Summary
MAL-2026-17758: Malicious code in react-dropzone-v4 (npm). Affects react-dropzone-v4 versions 99.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
react-dropzone-v4 is an npm package that mimics the popular react-dropzone library, designed for file uploads in React applications. However, this specific version (99.0.0) has been identified as malicious, containing no legitimate functionality and instead executing harmful scripts during installation. The package's inflated version number is characteristic of dependency-confusion attacks, which can trick systems into using this malicious package instead of a legitimate one.
Vulnerability Detail
The vulnerability originates from a preinstall lifecycle script defined in the package's package.json file. This script performs an nslookup and a curl GET request to a domain associated with malicious activity, transmitting the installer's hostname to a third-party server without user consent. This behavior compromises user privacy and can lead to further exploitation. The package has been flagged by security analysis tools for its malicious intent, making it a significant risk for any project that inadvertently installs it.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall react-dropzone-v4If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid installing the react-dropzone-v4 package altogether. If it has already been installed, remove it immediately and replace it with a trusted alternative. You can also use tools like Vulert to monitor your project for vulnerabilities in real-time.
Conclusion
The react-dropzone-v4 package poses a significant risk due to its malicious code that compromises user privacy. It is essential to remove this package from any projects and replace it with a legitimate alternative. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for react-dropzone-v4 →
FAQ
react-dropzone-v4 is an npm package that mimics the popular react-dropzone library for handling file uploads in React applications.
The vulnerability manifests through a preinstall script that sends the hostname of the user's machine to a malicious server, compromising user privacy.
If you have installed react-dropzone-v4, you should uninstall it immediately using 'npm uninstall react-dropzone-v4' and replace it with a legitimate alternative.
You can use Vulert, which requires only your package-lock.json file to monitor and alert you in real-time for open-source vulnerabilities.
Yes, the legitimate react-dropzone package is safe to use and should be preferred over the malicious react-dropzone-v4.
