Malicious Code Detected in react-transition-group-legacy Package - Version 100.0.0
Summary
MAL-2026-57: Malicious code in react-transition-group-legacy (npm). Affects react-transition-group-legacy versions 100.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The react-transition-group-legacy package is a legacy version of the popular React library used for managing transitions and animations in web applications. It provides a simple API for creating animations when components enter or leave the DOM. However, the specific version 100.0.0 has been flagged for malicious activity, raising concerns about its security and the integrity of applications that depend on it.
Vulnerability Detail
The vulnerability stems from the react-transition-group-legacy package version 100.0.0, which has been identified as malicious by the OpenSSF Package Analysis project. This package communicates with a domain associated with malicious activities, potentially compromising the security of applications that utilize it. The ramifications include unauthorized data access, potential data breaches, and the risk of further exploitation through the malicious code embedded in the package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall react-transition-group-legacyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the react-transition-group-legacy package from your project and replace it with a different package that offers similar functionality, such as react-transition-group. This can be done with the following command: npm uninstall react-transition-group-legacy && npm install react-transition-group.
Conclusion
The react-transition-group-legacy package version 100.0.0 has been identified as malicious, posing significant security risks to applications that utilize it. It is crucial to take immediate action by removing the affected package and replacing it with a secure alternative. Regular monitoring of dependencies using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for react-transition-group-legacy →
FAQ
It is a legacy version of a React library used for managing transitions and animations in web applications.
Version 100.0.0 has been flagged for communicating with a domain associated with malicious activity.
Using this package can lead to unauthorized data access, potential data breaches, and exploitation of the application.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software by analyzing your package-lock.json file. Visit Vulert Scanner for a quick check.
As a temporary measure, consider using an alternative package that provides similar functionality, such as react-transition-group.
