Malicious code in fuel-react (npm)
The npm package fuel-react contained malicious code in its postinstall.js script that executed automatically during installation, collecting and exfiltrating host identity and environment variables including credentials. The package name mimicked legitimate React tooling to evade detection.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed fuel-react via npm
- Ecosystems
- Attack vectors
- Affected entities
- fuel-reactnpm package with malicious postinstall.js script
The npm package fuel-react was distributed with a malicious postinstall.js script that executed automatically when the package was installed via npm. The script performed host reconnaissance by collecting the system hostname and process environment variables using os.hostname() and process.env, then transmitted this data via HTTPS requests to an attacker-controlled endpoint.
The package name was deliberately chosen to mimic common React tooling, making it appear legitimate to developers. This typosquatting-adjacent naming strategy increased the likelihood of accidental installation or confusion with legitimate packages.
The exfiltrated environment variables frequently contain sensitive credentials such as npm authentication tokens, CI/CD secrets, and cloud provider keys. This represents a critical supply chain risk as compromised credentials could enable further attacks on downstream systems and services.
The incident was identified and reported through the OpenSSF's malicious-packages repository, indicating coordinated security community response to the threat.
Indicators of compromise
- Packages
- fuel-react
Remediation
- Immediately uninstall fuel-react from all systems and CI/CD pipelines
- Rotate all npm tokens, CI/CD secrets, and cloud credentials that may have been exposed
- Audit npm install logs and CI/CD execution logs to identify all systems that installed the malicious package
- Review and revoke any unauthorized access or API calls made using potentially compromised credentials
- Implement npm package verification and scanning in CI/CD pipelines to detect malicious postinstall scripts
- Use npm audit and security scanning tools to identify other potentially malicious packages
- Consider using npm package lockfiles and integrity verification to prevent unexpected package modifications
Sources
- GitHub Advisory GHSA-77vr-cf3r-2v4w · GitHub Advisory Database
Cite this entry
"Malicious code in fuel-react (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 22, 2026; last updated August 22, 2026. https://supplychainattack.org/incident/malicious-code-in-fuel-react-npm-fjctc8
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in svelte-dim-kit
The npm package svelte-dim-kit was found to contain malware, potentially giving attackers full control of affected systems. All systems with this package installed should be considered compromised and secrets/keys rotated immediately from a different computer.
npmCompromised package - containedcritical
Malicious code in @syncraft-labs/react (npm)
The npm package @syncraft-labs/react contained obfuscated malicious code in its ESM distribution that implements the EtherHiding pattern, fetching and executing arbitrary code from an Ethereum smart contract via RPC endpoints. The tampering occurred post-build in the dist/index.js artifact.
npmCompromised package - containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in stillm4ddpocs-rtest-bravo (npm)
The npm package stillm4ddpocs-rtest-bravo contained malicious code in its preinstall script that automatically executed during installation, collecting system information and internal package metadata and exfiltrating it to a third-party Interactsh collector via HTTPS and DNS tunneling.
npmCompromised package