Malicious Code Detected in @shadowmonarchx/eslint_plugin_react: Version 7.29.6 Compromised
Summary
MAL-2025-5758: Malicious code in @shadowmonarchx/eslint_plugin_react (npm). Affects @shadowmonarchx/eslint_plugin_react versions >= 7.29.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package @shadowmonarchx/eslint_plugin_react is an npm package designed to provide linting capabilities for React applications. It is intended to help developers maintain code quality by identifying potential issues and enforcing coding standards. However, the package has been identified as malicious due to its communication with a domain associated with harmful activities, raising significant security concerns for users.
Vulnerability Detail
The vulnerability stems from the package version 7.29.6, which has been flagged for engaging in malicious behavior. It communicates with a domain linked to malicious activities and executes commands that could compromise the security of the host application. This could lead to unauthorized access, data breaches, or other forms of exploitation, making it critical for users to address this issue promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @shadowmonarchx/eslint_plugin_reactIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can remove the package from their project until a secure version is confirmed. This can be done by executing: npm uninstall @shadowmonarchx/eslint_plugin_react. Additionally, consider using alternative linting packages that do not have known vulnerabilities.
Conclusion
The @shadowmonarchx/eslint_plugin_react package version 7.29.6 has been identified as malicious, posing significant risks to users. It is crucial to update to a secure version or remove the package until a fix is available. Staying informed and utilizing monitoring tools like Vulert can help mitigate risks associated with open-source vulnerabilities.
See every vulnerability recorded for @shadowmonarchx/eslint_plugin_react →
FAQ
The package communicates with a domain associated with malicious activities and executes commands that may compromise the security of the application.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without needing to sign up.
If an immediate update is not possible, consider removing the package from your project as a temporary workaround until a secure version is available.
Yes, consider using other linting packages that provide similar functionality without the associated risks. Research and select a reputable alternative.
Regularly check for updates from the package maintainers and utilize tools like Vulert to monitor your dependencies for vulnerabilities.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
