Skip to content
supplychainattack.orgSupply chain attack incident catalog
activecritical

Malware in enbd-react-error-boundry

Malware discovered in the npm package enbd-react-error-boundry. The package grants full system compromise to attackers, requiring immediate removal and credential rotation from a clean system.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any system with the package installed or running
Ecosystems
Attack vectors
Affected entities
  • enbd-react-error-boundry

A malicious npm package named enbd-react-error-boundry has been identified as containing malware. According to the GitHub Advisory (GHSA-jffm-72cc-xcwv), any computer with this package installed or running should be considered fully compromised.\n\nThe advisory indicates that all secrets and keys stored on affected computers should be rotated immediately from a different, uncompromised system. While the package should be removed, the advisory notes that full control of the computer may have been given to an outside entity, meaning removal of the package alone may not eliminate all malicious software that resulted from the installation.\n\nThis represents a critical supply chain attack through a compromised npm package with severe impact on system security and data confidentiality.

Indicators of compromise

Packages
  • enbd-react-error-boundry

Remediation

  • Immediately remove the enbd-react-error-boundry package from all affected systems
  • Rotate all secrets, API keys, and credentials from a clean, uncompromised computer
  • Perform a full security audit and malware scan of any system that had this package installed
  • Review system logs and network traffic for signs of unauthorized access or data exfiltration
  • Consider the affected system(s) potentially compromised and plan for full rebuild if critical systems are involved
  • Check dependency trees to identify any projects that may have included this package as a transitive dependency

Sources

  1. GitHub Advisory GHSA-jffm-72cc-xcwv · GitHub Advisory Database

Cite this entry

"Malware in enbd-react-error-boundry." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 14, 2026; last updated July 14, 2026. https://supplychainattack.org/incident/malware-in-enbd-react-error-boundry-1og6c7

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

  1. containedcritical

    Malware in @logdna-web/styles

    Malware was discovered in the npm package @logdna-web/styles. Systems with this package installed are considered fully compromised and require immediate remediation.

    npmCompromised package
  2. activecritical

    Malware in @flex-ng/filter-pipe

    Malware discovered in the npm package @flex-ng/filter-pipe. Systems with this package installed are considered fully compromised and require immediate remediation.

    npmCompromised package
  3. activecritical

    Malware in @idms-corp/auth-ui

    Malware discovered in the npm package @idms-corp/auth-ui. Systems with this package installed are considered fully compromised, with potential for complete system takeover.

    npmCompromised package
  4. activecritical

    Malware in salesforce-vscode-slds

    Malware was discovered in the npm package salesforce-vscode-slds. Any system with this package installed is considered fully compromised and poses a critical risk to stored secrets and keys.

    npmCompromised package