Malicious Code Execution Vulnerability in react-nodejs Package
Summary
MAL-2026-17294: Malicious code in react-nodejs (npm). Affects react-nodejs versions 19.3.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The react-nodejs package is an npm package that aims to provide a Node.js implementation for React applications. It is designed to facilitate server-side rendering and enhance performance for React-based applications. However, this package has been found to contain a significant vulnerability that allows for the execution of malicious code during installation, posing a serious risk to users.
Vulnerability Detail
The vulnerability originates from a preinstall lifecycle hook defined in the package.json file of react-nodejs. This hook executes a command that fetches a JavaScript file from an unverified third-party repository and runs it on the user's machine during the npm install process. The fetched code is unpinned and unverified, controlled by an unrelated user, which can lead to remote code execution and potential compromise of the user's environment. The package also impersonates the React framework, amplifying the risk of users mistakenly trusting it.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall react-nodejsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can avoid using the react-nodejs package altogether and look for alternative packages that provide similar functionality without the associated risks. Additionally, you can manually inspect the package.json file of any npm package before installation to ensure it does not contain malicious hooks.
Conclusion
The react-nodejs package contains a serious vulnerability that allows for the execution of malicious code during installation. Users are advised to remove the package and consider alternatives while ensuring to monitor their projects for vulnerabilities using tools like Vulert.
See every vulnerability recorded for react-nodejs →
FAQ
The react-nodejs package is an npm package designed to facilitate server-side rendering of React applications in a Node.js environment.
The vulnerability allows for the execution of malicious code on your machine during the installation of the package, potentially compromising your system.
If you have installed the react-nodejs package, it is recommended to remove it immediately and check your system for any signs of compromise.
You can use tools like Vulert, which monitors your package-lock.json file to alert you in real-time for open-source vulnerabilities in your software.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
