Malicious code in react-dom-helpers (npm)
The npm package react-dom-helpers, a typosquat of the legitimate react-dom, contained malicious code that exfiltrated host identifiers (local IPv4 addresses, public IP, and system information) to a hardcoded Slack webhook on module load.
- Disclosed
- Last updated
- Blast radius
- Any developer or application that installed the malicious react-dom-helpers package
- Ecosystems
- Attack vectors
- Affected entities
- react-dom-helpersTyposquatting package targeting react-dom
The malicious npm package react-dom-helpers was designed to typosquat the legitimate react-dom package. When the module was loaded via require('react-dom-helpers/client'), it executed a malicious routine unconditionally.
The attack involved decoding a base64-obfuscated Slack bot token and channel ID embedded in the package code. The malicious code then enumerated local IPv4 addresses using os.networkInterfaces(), fetched the installer's public IP from api.ipify.org, and exfiltrated this host identification data via a POST request to https://slack.com/api/chat.postMessage using the hardcoded bearer token.
The base64 encoding of the Slack credentials was used to evade automated secret scanning tools. The exfiltration routine ran automatically upon module import, affecting any developer or application that installed the package.
The incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- react-dom-helpers
- Domains
- api.ipify.org
- slack.com
Remediation
- Immediately uninstall react-dom-helpers from all affected systems and projects
- Audit npm package.json and lock files for any installations of react-dom-helpers
- Replace with the legitimate react-dom package
- Review system logs and network traffic for evidence of data exfiltration to Slack API endpoints
- Rotate any credentials or tokens that may have been exposed on affected systems
- Implement package name verification and typosquat detection in dependency management workflows
- Use npm audit and security scanning tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-j99x-jjfh-7qh6 · GitHub Advisory Database
Cite this entry
"Malicious code in react-dom-helpers (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-react-dom-helpers-npm-1qttje
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package