MAL-2026-1837

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-query-core-utils/MAL-2026-1837.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-1837

Published

2026-03-18T13:07:07Z

Modified

2026-03-23T05:45:26.381488Z

Summary

Malicious code in react-query-core-utils (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3bce94f40a0e1879b184cd9f5abb5f4850d66aa5705b231b41337c2e2e33a3de)

The package react-query-core-utils was found to contain malicious code.

Database specific

{
    "malicious-packages-origins": [
        {
            "sha256": "1a3e776ed61f53631d9afd989879908a13c099492da8d9ffd27a0b95f58fe81e",
            "import_time": "2026-03-19T12:19:08.888543166Z",
            "modified_time": "2026-03-18T13:07:07Z",
            "versions": [
                "4.4.1",
                "4.4.2",
                "4.4.3",
                "4.4.4",
                "4.4.5",
                "4.4.6",
                "4.4.7",
                "4.4.8",
                "4.4.9",
                "4.5.1",
                "4.5.2",
                "4.5.3"
            ],
            "id": "RLMA-2026-01534",
            "source": "reversing-labs"
        },
        {
            "sha256": "3bce94f40a0e1879b184cd9f5abb5f4850d66aa5705b231b41337c2e2e33a3de",
            "import_time": "2026-03-23T05:14:19.943557865Z",
            "modified_time": "2026-03-23T05:11:41Z",
            "versions": [
                "4.4.1",
                "4.4.2",
                "4.4.3",
                "4.4.4",
                "4.4.5",
                "4.4.6",
                "4.4.7",
                "4.4.8",
                "4.4.9",
                "4.5.1",
                "4.5.2",
                "4.5.3"
            ],
            "source": "amazon-inspector"
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - actran@amazon.com
- ReversingLabs - FINDER
- - https://www.reversinglabs.com

Affected packages

npm / react-query-core-utils

Package

Name: react-query-core-utils; View open source insights on deps.dev
Purl: pkg:npm/react-query-core-utils

Affected ranges

Affected versions

4.*

4.4.1

4.4.2

4.4.3

4.4.4

4.4.5

4.4.6

4.4.7

4.4.8

4.4.9

4.5.1

4.5.2

4.5.3

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-query-core-utils/MAL-2026-1837.json"