{"id":"MAL-2026-17758","revision":"a770615e7d234f95ac558956ee12e764","records":[{"revision":"a770615e7d234f95ac558956ee12e764","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17758","aliases":[],"title":"Malicious code in react-dropzone-v4 (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (28267e7286151b52836170e94617afcb3c49d17424f7b7ea9fab480c6e008c7c)\nThe package's package.json declares a preinstall lifecycle script that runs automatically on npm install. The script performs an nslookup of $(hostname).hzbvy3cmgred066nig6n3ux0y.canarytokens.com and a curl GET to http://hzbvy3cmgred066nig6n3ux0y.canarytokens.com/$(hostname), causing the installer's hostname to be transmitted to a third-party canarytokens.com subdomain via DNS and plaintext HTTP without consent. The package name mimics the popular react-dropzone library and uses an inflated version number (99.0.0) characteristic of dependency-confusion attacks that aim to win resolution against an internal package of the same name. The package provides no legitimate functionality; its only install-time effect is the out-of-band beacon identifying hosts that resolved and installed it.\n\n## Source: ossf-package-analysis (a198afa2f10e287b1c9d5f196f5ca43288ccf306b9dc753a4d04221c3c91f76b)\nThe OpenSSF Package Analysis project identified 'react-dropzone-v4' @ 99.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","state":0,"publishedAt":"2026-10-11T07:35:19+00:00","modifiedAt":"2026-10-11T14:30:08.7708432+00:00","affected":[{"ecosystem":"npm","name":"react-dropzone-v4","ranges":[],"versions":["99.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/react-dropzone-v4/v/99.0.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17758","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17758","identifiers":["MAL-2026-17758"]},"retained":false,"historicalAffected":[]}],"coverage":[]}