MAL-2026-17758

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-dropzone-v4/MAL-2026-17758.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17758
Published
2026-10-11T07:35:19Z
Modified
2026-10-11T14:30:08Z
Summary
Malicious code in react-dropzone-v4 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (28267e7286151b52836170e94617afcb3c49d17424f7b7ea9fab480c6e008c7c)

The package's package.json declares a preinstall lifecycle script that runs automatically on npm install. The script performs an nslookup of $(hostname).hzbvy3cmgred066nig6n3ux0y.canarytokens.com and a curl GET to http://hzbvy3cmgred066nig6n3ux0y.canarytokens.com/$(hostname), causing the installer's hostname to be transmitted to a third-party canarytokens.com subdomain via DNS and plaintext HTTP without consent. The package name mimics the popular react-dropzone library and uses an inflated version number (99.0.0) characteristic of dependency-confusion attacks that aim to win resolution against an internal package of the same name. The package provides no legitimate functionality; its only install-time effect is the out-of-band beacon identifying hosts that resolved and installed it.

Source: ossf-package-analysis (a198afa2f10e287b1c9d5f196f5ca43288ccf306b9dc753a4d04221c3c91f76b)

The OpenSSF Package Analysis project identified 'react-dropzone-v4' @ 99.0.0 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-10-11T07:47:21.562722481Z",
            "modified_time": "2026-10-11T07:35:19Z",
            "sha256": "a198afa2f10e287b1c9d5f196f5ca43288ccf306b9dc753a4d04221c3c91f76b",
            "source": "ossf-package-analysis",
            "versions": [
                "99.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-021443",
            "import_time": "2026-10-11T14:18:06.491368239Z",
            "modified_time": "2026-10-11T14:00:37Z",
            "sha256": "28267e7286151b52836170e94617afcb3c49d17424f7b7ea9fab480c6e008c7c",
            "source": "amazon-inspector",
            "versions": [
                "99.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / react-dropzone-v4

Package

Name
react-dropzone-v4
View open source insights on deps.dev
Purl
pkg:npm/react-dropzone-v4

Affected ranges

Affected versions

99.*
99.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "7c43e55749b4cf28c292f65d4733c3187ea95608b27173f331b4cc2638df6ef8",
            "tlsh": "4fe06a340834943719fd8ed11cb0d80b2012dc3740159d8c9a070318654db7345bf698"
        }
    ],
    "package_integrity": [
        {
            "filename": "react-dropzone-v4-99.0.0.tgz",
            "hashes": {
                "sha1": "8f40ab77e93bd0bd09f4ba3c1eeeabe4586716c6",
                "sha512_sri": "sha512-6dVvCJ+5a/Y0cB3UDa60vqzjjHQ3qf7JO+edqcAa8ITNouTKZs6/0s16v1yRuJa97bD7zWJt8R1yGJgvwr8k4w=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-dropzone-v4/MAL-2026-17758.json"