MAL-2026-14355

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fuel-react/MAL-2026-14355.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14355
Published
2026-08-21T22:10:33Z
Modified
2026-08-21T23:00:49Z
Summary
Malicious code in fuel-react (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8e35f4772b8cba3555519c250662c67395bf57d89feed3feba7ea067b6bb2c27)

The package's postinstall.js script executes automatically on npm install and collects host identity plus environment variables (os.hostname(), process.env) and transmits them via an https request. The package name mimics common React tooling but the shipped install-time behavior is host reconnaissance and environment-variable exfiltration, which frequently captures credentials such as npm tokens, CI secrets, and cloud keys present in process.env.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018511",
            "import_time": "2026-08-21T22:42:49.833847742Z",
            "modified_time": "2026-08-21T22:10:33Z",
            "sha256": "8e35f4772b8cba3555519c250662c67395bf57d89feed3feba7ea067b6bb2c27",
            "source": "amazon-inspector",
            "versions": [
                "91.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / fuel-react

Package

Name
fuel-react
View open source insights on deps.dev
Purl
pkg:npm/fuel-react

Affected ranges

Affected versions

91.*
91.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "ac5fc56c8ba471dde0d6c9dff5e5ebf315507119166a1edb89b1bba81692f65d",
            "tlsh": "b03185a886f249a223f1528c46872005336dc0237804fd98b94d93981f99bfdc1f36dd"
        }
    ],
    "package_integrity": [
        {
            "filename": "fuel-react-91.0.0.tgz",
            "hashes": {
                "sha1": "cc86fe0e31125258856beceea163cf265821fffb",
                "sha512_sri": "sha512-qnETbSIZ8iZNTA9fNpDMkm8ArPBHcrrCJ+vODcpbjsF+38wA0LXKebh75qDFRuLwAKL7Gn5Laka4VPHwbpRXDg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fuel-react/MAL-2026-14355.json"