Malicious Code Detected in reactjs-risk Package: Identity Metadata Exfiltration
Summary
MAL-2026-17339: Malicious code in reactjs-risk (npm). Affects reactjs-risk versions 99.12.0 – 99.9.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The reactjs-risk package is an npm library that, under normal circumstances, would provide functionality for React.js applications. However, it has been identified as malicious due to its behavior during installation. The package's preinstall lifecycle script is designed to collect sensitive identity metadata from the user's machine, including the hostname, username, and platform, and transmit this information to a third-party domain.
Vulnerability Detail
The vulnerability originates from the reactjs-risk package's preinstall script, which executes without user consent. It collects sensitive information such as the installer's hostname, username, and platform, and sends this data to a malicious DNS endpoint. This behavior is indicative of embedded malicious code, as the package does not provide any legitimate functionality and is designed solely for data exfiltration. The deliberate obfuscation of the code further complicates detection and highlights the malicious intent behind its design.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall reactjs-riskIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid installing the reactjs-risk package altogether. If it is already installed, you can remove it using the command: npm uninstall reactjs-risk. Additionally, consider using tools like Vulert to monitor your package dependencies for vulnerabilities.
Conclusion
The reactjs-risk package poses a significant security risk due to its malicious behavior of exfiltrating sensitive identity metadata. Users are advised to uninstall the package and monitor their systems for any unauthorized access. Regularly updating packages and utilizing tools like Vulert can help mitigate such risks in the future.
See every vulnerability recorded for reactjs-risk →
FAQ
reactjs-risk is an npm package that has been identified as malicious due to its behavior of collecting and exfiltrating sensitive user information during installation.
The vulnerability can lead to unauthorized exposure of sensitive identity metadata, which could be exploited by malicious actors for various purposes, including targeted attacks.
If you have installed reactjs-risk, it is recommended to uninstall the package immediately and monitor your system for any suspicious activity.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check your application for vulnerabilities using the Vulert playground without any signup.
To prevent similar vulnerabilities, always review package dependencies, use trusted sources, and employ tools like Vulert to monitor for vulnerabilities in your projects.
