LWA-2026-6445 confirmed malware
react-dom-v17@22.1.1
Malicious code in react-dom-v17 (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1082 · System Information DiscoveryT1041 · Exfiltration Over C2 ChannelT1071.001 · Web Protocols
Analysis
Combosquat package impersonating react-dom (react-dom-v17@22.1.1) runs a preinstall script that collects detailed system fingerprint data — hostname, platform, architecture, home directory, username, uid, gid, shell, OS type/release, CPU count, whoami output, id output, and current working directory — and exfiltrates it via HTTPS POST to p7xaw8rwxljb2hay3ann6pblgcm3atyi[.]oastify[.]com/detox56. The package also bundles a large Instagram follow-request data dump (package/i) containing scraped user profiles.
- analyzed by
- Leitwacht
- first seen
- Jul 8, 2026, 05:36 AM
- analyzed
- Jul 8, 2026, 05:37 AM
Related advisories
- rio-design-tokens@99.99.99
- hello244b@1.0.0
- sn-flow-client@20.5.1
- mcp-server-pg@0.2.0
- motion-pull@2.3.5
- configration@2.3.5
- chai-smart@2.3.5
- express-mongo-limit@2.0.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.