react-next-dom@1.1.7

Analysis

react-next-dom@1.1.7 is a remote-code-execution trojan. It spawns a detached child process (index.js spawns caller.js with detached:true) that fetches arbitrary JavaScript from jsonkeeper[.]com/b/XRGF3 via axios, then executes it with full Node require access through new Function.constructor('require', payload). The target URL and request headers are base64-obfuscated in a fake process.env block. A 5-attempt retry loop ensures payload delivery survives transient network issues. The package name combosquats React/Next.js branding; publisher uses a temp-mail domain (ellbit[.]com); description is generic copy-paste unrelated to the code. The package depends on axios (the C2 transport) and sqlite3 (whose native build failure caused the install to fail before the payload could run — the malicious code in caller.js is otherwise fully wired).