@reaxuse/integrations@0.0.1

Analysis

This package is a React port of the legitimate @vueuse/integrations library, published as part of a coordinated campaign that has distributed malware across many packages under the same publishing identity. The package ships clean React hooks (useAsyncValidator, useAxios, useChangeCase, useCookies, useSortable, useDrauu, useFocusTrap, useIDBKeyval, useNProgress, useFuse, useJwt, useQRCode) with no install hooks and no network behaviour of its own, but it is a clone of a well-known library published by an identity with a history of distributing malicious packages, consistent with a decoy or reputation-building package in a supply-chain attack campaign.