MAL-2026-14368

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@syncraft-labs/react/MAL-2026-14368.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14368
Published
2026-08-23T03:15:14Z
Modified
2026-08-23T03:30:23.853998865Z
Summary
Malicious code in @syncraft-labs/react (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c3986bd05347035d9263c22b871840f19dc42187d3e1719311cb67c6e1ef5cb9)

dist/index.js (the ESM entry resolved by default by modern bundlers such as Vite, Next.js, and Webpack) contains a heavily obfuscated block using obfuscator.io-style identifiers, a rotated ~300-entry string array, and a decoder wrapper injected inside the useEffect body of the useSync hook. The block captures globalThis.r=require and globalThis.m=module, then uses http/https and zlib (createInflate/createBrotli) to fetch data from Ethereum RPC endpoints (h.drpc.org, 1rpc.io/eth), Blockscout, and Etherscan for a hardcoded contract address (0xa322E5f3...), reconstructs code from the on-chain bytes, and executes it with require access. This is the EtherHiding pattern: the on-chain contract is mutable, so operators of that contract can deliver arbitrary JavaScript to any consumer that renders a component using useSync, achieving remote code execution in Node build/SSR contexts and in the browser bundle of downstream applications. The obfuscated blob is absent from dist/index.cjs and from the TypeScript sources referenced by dist/index.js.map, indicating the ESM artifact was tampered after build.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-23T03:15:14Z",
            "versions": [
                "0.4.1"
            ],
            "sha256": "c3986bd05347035d9263c22b871840f19dc42187d3e1719311cb67c6e1ef5cb9",
            "id": "IN-MAL-2026-018573",
            "import_time": "2026-08-23T03:25:56.573012628Z"
        }
    ]
}
References
Credits

Affected packages

npm / @syncraft-labs/react

Package

Name
@syncraft-labs/react
View open source insights on deps.dev
Purl
pkg:npm/%40syncraft-labs/react

Affected ranges

Affected versions

0.*
0.4.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@syncraft-labs/react/MAL-2026-14368.json"
indicators 
{
    "evidence_files": [
        {
            "path": "dist/index.js",
            "sha256": "5b6c555d11703bf2c11f5745c0926fd6f0f75f6d482dbe701cb6b5acae11c187",
            "tlsh": "aa03a580b7e1644003476abb7b1ff4e5e56b08ad35888ac6f11cba84ef96327e4f1535"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "e56b6dd3158153a09b48f458c73fe4d0b7a1de4d",
                "sha512_sri": "sha512-wtbb2ajdjTj/U7qCrTzjY6vvyczyHyk2rrOSIAStFGLPSgvbLobf+BTF4UjXkRD3VVZk5eIK+67zH593IcrK/Q=="
            },
            "filename": "react-0.4.1.tgz"
        }
    ]
}