Malicious Code Detected in react-markdown-canvas: A Critical Security Alert
Summary
MAL-2026-1040: Malicious code in react-markdown-canvas (npm). Affects react-markdown-canvas versions 1001.0.0 – 1005.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
react-markdown-canvas is an npm package designed to facilitate the rendering of Markdown content on canvas elements, allowing for interactive and visually appealing presentations of text. It is widely used in web applications that require Markdown support. However, the package has been identified as malicious, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability stems from the package version 1001.0.0, which has been flagged for communicating with a domain associated with malicious activities. This behavior could lead to data breaches, unauthorized access, or other forms of exploitation, compromising the integrity and security of applications that depend on this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall react-markdown-canvasIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the react-markdown-canvas package from your project until a secure version is released. You can do this by running: npm uninstall react-markdown-canvas. Alternatively, you may explore other Markdown rendering libraries that do not exhibit malicious behavior.
Conclusion
The react-markdown-canvas package has been flagged for malicious behavior, necessitating immediate action from developers using this package. By updating to a secure version or removing the package, you can protect your applications from potential security threats. Stay vigilant and utilize tools like Vulert to monitor your dependencies for vulnerabilities.
See every vulnerability recorded for react-markdown-canvas →
FAQ
react-markdown-canvas is an npm package that allows developers to render Markdown content on HTML canvas elements, enhancing the visual presentation of text.
The package has been identified as malicious due to its communication with a domain linked to harmful activities, posing security risks to applications using it.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your package-lock.json file to the Vulert playground at Vulert Scanner to check for vulnerabilities without any signup.
If you cannot update the package right away, consider uninstalling it or using an alternative Markdown rendering library until a secure version is available.
Utilize tools like Vulert to monitor your dependencies for vulnerabilities in real-time, ensuring you are alerted to any security issues as they arise.
