react-dev-testloader@12.0.1

Analysis

This package publishes the source tree of facebook/react-dev-utils under a name that is not the upstream package. Its package.json declares the upstream repository (git+hxxps://github[.]com/facebook/create-react-app[.]git, directory packages/react-dev-utils), the upstream description "webpack utilities used by Create React App", version 12.0.1, and the upstream dependency set, and every shipped file carries the "Copyright (c) 2015-present, Facebook, Inc." MIT header — so an installer can easily mistake it for the real react-dev-utils. The shipped JavaScript in this version contains no install lifecycle hook (scripts declares only "test"), no bin entries, no obfuscation, no eval/atob/Function-constructor use, and no outbound network destinations beyond upstream documentation URLs; the child_process usage is the upstream editor-launching (launchEditor.js spawning $REACT_EDITOR/$VISUAL/$EDITOR, getProcessForPort.js running ps/lsof) and browser-opening (openBrowser.js invoking osascript openChrome.applescript) helpers. No credential, token, .npmrc, SSH-key or wallet access was found in the shipped files. The risk is the name impersonation of a widely depended-on library: consumers resolving react-dev-testloader instead of react-dev-utils receive code attributed to a project it does not belong to, and the name is positioned to serve a later payload swap. No network IOC was observed in this version.