MAL-2026-12189

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-scroll-disable/MAL-2026-12189.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12189
Published
2026-08-05T09:08:43Z
Modified
2026-08-05T10:06:14.225631162Z
Summary
Malicious code in react-scroll-disable (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (30e2eae248242fe92d777348542534e187d7773c2a092e8d3240d8bdd5b94afa)

On require of react-scroll-disable, the package's main entry executes an eval(atob(...)) blob appended after the legitimate RemoveScroll export. The blob loads child_process and http via \uXXXX-escaped identifiers, queries public Ethereum RPCs for the latest transaction to address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the transaction's to field into two IPv4 addresses, and issues GET/HEAD requests to those hosts on port 443 (paths /0x/cls and /0x/ls). The response carries an XOR-encrypted second-stage script in an x-payload-b64 header, which is decrypted and executed via spawn('node', ['-e', <payload>], {detached: true, stdio: 'ignore', windowsHide: true}).unref(), producing a detached child process running attacker-controlled code with no user interaction. The same payload is present in both dist/es2015 and dist/es2019 entry files. The attacker rotates the delivery IP by publishing new on-chain transactions, so the fetched code changes without any package update.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014564",
            "import_time": "2026-08-05T09:28:26.00658408Z",
            "sha256": "30e2eae248242fe92d777348542534e187d7773c2a092e8d3240d8bdd5b94afa",
            "modified_time": "2026-08-05T09:08:43Z",
            "versions": [
                "2.5.2"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / react-scroll-disable

Package

Name
react-scroll-disable
View open source insights on deps.dev
Purl
pkg:npm/react-scroll-disable

Affected ranges

Affected versions

2.*
2.5.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-AfyYnXHGqjLJMFmHrrq2modTRvpHT34YnQSeF9nihZ9/G1Ay8+/DlCWJEh1IVTUBYvAXeAy+G6vdW8zgogB7cA==",
                "sha1": "0feefde36211ea6d62258dc95a147da08e7907d2"
            },
            "filename": "react-scroll-disable-2.5.2.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "dist/es5/index.js",
            "sha256": "a480bacf385a0ea75fbe615817f3e764e7b55fb25653171aef9f91771ed608a1",
            "tlsh": "05424daa06a27a9bcf0b2673fd97570d237140b266ac2f09311fd875b389c95744e60f"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-scroll-disable/MAL-2026-12189.json"