MAL-2026-17777

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-paginate-v5/MAL-2026-17777.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17777
Published
2026-10-11T13:58:11Z
Modified
2026-10-11T14:30:09Z
Summary
Malicious code in react-paginate-v5 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2c0f91fe35323a6f47033b90ebaf88498a36fd7e8e933711b2cf301dba2e4759)

react-paginate-v5@99.0.0 is a dependency-confusion probe published under a name resembling the popular react-paginate package and pinned to an implausibly high version (99.0.0) to win resolution against an internal package. Its package.json declares a preinstall lifecycle script that runs nslookup dep-confusion-poc.2chsn9exkdupkr3cxed7vp7sk.canarytokens.com, which fires automatically on npm install and emits a DNS query from the installer's resolver to an attacker/researcher-controlled canary subdomain. The subdomain label (dep-confusion-poc) self-identifies the operation as a dependency-confusion test. The DNS lookup confirms successful installation to the operator of the canary token, identifying hosts and networks where an internal package name was shadowed by this public squat. While the beacon itself only exfiltrates the fact of installation plus resolver metadata, the same install-time execution primitive can carry any shell command, and the package has no legitimate functionality.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-021429",
            "import_time": "2026-10-11T14:18:04.861546546Z",
            "modified_time": "2026-10-11T13:58:11Z",
            "sha256": "2c0f91fe35323a6f47033b90ebaf88498a36fd7e8e933711b2cf301dba2e4759",
            "source": "amazon-inspector",
            "versions": [
                "99.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / react-paginate-v5

Package

Name
react-paginate-v5
View open source insights on deps.dev
Purl
pkg:npm/react-paginate-v5

Affected ranges

Affected versions

99.*
99.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "e4ddadc2953f2675846dc3eb28ff1a9f106ddb9202ab6bdef575a8ba8201b32f",
            "tlsh": "3ae07d34ac21583319f982f70872550716b3dc6a9019bd0ea75ba00ce5ceeb3937b148"
        }
    ],
    "package_integrity": [
        {
            "filename": "react-paginate-v5-99.0.0.tgz",
            "hashes": {
                "sha1": "cfdcb7e56ec646f42f229f7eed0a0e3099e6180b",
                "sha512_sri": "sha512-miYSw1WOeIy/dXd+24lX0KfQ1+eEqzyoEKHM+LN5YFQ0ZclyLcsQlfQNHZHePIje19XPBXGjx35Muf/vgRs17Q=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-paginate-v5/MAL-2026-17777.json"