Dependency Confusion Vulnerability in react-paginate-v5: Malicious Code Execution Risk
Summary
MAL-2026-17777: Malicious code in react-paginate-v5 (npm). Affects react-paginate-v5 versions 99.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
react-paginate-v5 is a JavaScript package designed for pagination in React applications. It provides developers with an easy way to implement pagination features, enhancing user experience in applications that handle large datasets. However, the package version 99.0.0 has been identified as a malicious dependency that mimics the legitimate react-paginate package, posing significant security risks.
Vulnerability Detail
The vulnerability originates from a malicious version of the react-paginate-v5 package, specifically version 99.0.0, which is a dependency-confusion probe. This version is designed to win resolution against internal packages by using an implausibly high version number. It includes a preinstall lifecycle script that executes a DNS lookup to a canary domain controlled by an attacker. This action occurs automatically during the installation process, allowing the attacker to confirm successful installations and gather metadata about the resolver. The package lacks any legitimate functionality and can be exploited to execute arbitrary shell commands.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall react-paginate-v5If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the react-paginate-v5 package entirely until the issue is resolved. If you must use it, consider using a different package for pagination or implement pagination manually to mitigate risks.
Conclusion
The react-paginate-v5 package version 99.0.0 poses a significant security risk due to its malicious code designed to execute unauthorized commands. It is essential to remove this version and replace it with a legitimate one to safeguard your application. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for react-paginate-v5 →
FAQ
Dependency confusion occurs when a malicious package is published with the same name as an internal package, tricking the package manager into installing the malicious version instead of the intended internal one.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your package-lock.json file, it can identify if your application is affected by this vulnerability. Visit the Vulert playground at Vulert Scanner to check without any signup.
The risks include unauthorized code execution, data exfiltration, and potential compromise of the entire application environment, leading to severe security breaches.
To prevent similar vulnerabilities, always verify package sources, use package-lock files, and employ tools like Vulert to monitor for vulnerabilities in real-time.
If you have installed the malicious package, immediately remove it from your project and replace it with a legitimate version. Review your application for any signs of compromise.
