react-dev-testloader@10.0.1

Analysis

react-dev-testloader is a combosquat of the Create React App utility package react-dev-utils. Its package.json description ("webpack utilities used by Create React App"), homepage, bugs URL and repository field all point at github[.]com/facebook/create-react-app (directory packages/react-dev-utils), and the shipped source is a near-verbatim copy of react-dev-utils 12.0.1 — the same 37-file tree (launchEditor.js, WebpackDevServerUtils.js, webpackHotDevClient.js, openBrowser.js, getProcessForPort.js, evalSourceMapMiddleware.js, openChrome.applescript and the rest) with the same dependency list. Consumers installing this name receive Create React App's build tooling from a package that is not the upstream one, so any future publish of this name executes with the trust and install base of the real react-dev-utils. The published tarball itself declares no install or postinstall lifecycle hook (scripts contains only "test"), ships no bin entry, and contains no obfuscated or encoded payload; its only network code is the upstream dev-server WebSocket client in webpackHotDevClient.js, and its child_process use is the upstream editor-launching logic in launchEditor.js, getProcessForPort.js and openBrowser.js. No network IOC (C2 host, IP or URL) is present in this version.