Malicious code in react-puller (npm)

The npm package react-puller was published with malicious code embedded in its postinstall hook. When installed, the package executes node index.js, which spawns a detached worker process.\n\nThe worker downloads two Windows executables (CDPUserPlatform.exe and DOContentCacheMgr.exe) from a hardcoded bare-IP endpoint at http://64.49.11.161:8000 over unencrypted HTTP. These binaries are written to the ~/.react-pul directory and executed via cmd /c start.\n\nThe package establishes persistence by writing an HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry entry pointing to ~/.react-pul/DOContentCacheMgr.exe, ensuring the dropped binary executes on every user login. The package was disguised as a generic React utility, with no indication of this malicious behavior in its name or description.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.