MAL-2026-6571

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-wp-viewer/MAL-2026-6571.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6571
Published
2026-06-29T04:17:26Z
Modified
2026-06-29T05:16:42.720161425Z
Summary
Malicious code in react-wp-viewer (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (443f37b7957fe3f1d4dd836b3a0e6eeddb513e334700e0c0a4616570071c13d8)

react-wp-viewer 0.2.4 is a dependency-confusion package. Its postinstall hook performs an HTTP GET to a hardcoded bare-IP endpoint at http://130.49.177.51:18080/p/dc-20260627-yandex-geobase carrying the package name, version, and a fixed nonce. The package self-identifies as a dependency-confusion proof-of-concept (__dependency_confusion_poc__: true) and the URL path encodes a campaign identifier referencing an internal package namespace, indicating the public name is being squatted to win resolution against an identically-named private/internal package. Any build that resolves react-wp-viewer from the public registry will silently execute the postinstall beacon, disclosing the installer's source IP, hostname-derived network position, and the fact that this internal name resolves within their environment, to an attacker-controlled host over plain HTTP. No installer credentials are read in the traced code, but the install-time callout to an attacker-controlled IP is the dependency-confusion attack pattern and provides material reconnaissance value to the operator.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-06-29T04:17:26Z",
            "sha256": "08fd73c12a730e8dfbaa5bf21aa086a0a3de88241fbd6d880a20805838929572",
            "import_time": "2026-06-29T05:07:05.765202301Z",
            "versions": [
                "0.2.15"
            ],
            "ranges": [
                {
                    "type": "SEMVER",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007713"
        },
        {
            "import_time": "2026-06-29T05:07:06.066562413Z",
            "sha256": "443f37b7957fe3f1d4dd836b3a0e6eeddb513e334700e0c0a4616570071c13d8",
            "modified_time": "2026-06-29T04:17:42Z",
            "versions": [
                "0.2.4"
            ],
            "ranges": [
                {
                    "type": "SEMVER",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007715"
        },
        {
            "import_time": "2026-06-29T05:07:05.929844066Z",
            "sha256": "5b9202fdee16d26d0f7484f7f9a0d2d264b38ad3200b396ef483cc2439225360",
            "modified_time": "2026-06-29T04:17:35Z",
            "versions": [
                "0.2.99"
            ],
            "ranges": [
                {
                    "type": "SEMVER",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007714"
        }
    ]
}
References
Credits

Affected packages

npm / react-wp-viewer

Package

Name
react-wp-viewer
View open source insights on deps.dev
Purl
pkg:npm/react-wp-viewer

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.2.4
0.2.15
0.2.99

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "react-wp-viewer-0.2.15.tgz",
            "hashes": {
                "sha1": "2c07f5333e631d27ff6b7aa942dcd1f3605087aa",
                "sha512_sri": "sha512-oGM3xkjQzReHwrsEy9hoHOaIdmo7Ga1Gb73CIu5nAPiASgvr3pKZ0wso5zb7HusX40p2YWECxnDjKT5thV3lHQ=="
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "60f05cb856f580782ded41c9f3d1b85f95cee241f1557480ed9217d123d369326b26b0",
            "sha256": "4511fad6b3a02db6a7d6ceffff5f43aff822a423a273336b0dfb0aa02c28bade",
            "path": "postinstall.js"
        },
        {
            "tlsh": "7ce07d185821a73328c04a971577550694706d0b0108790c03e78838d3ce663c2be20f",
            "sha256": "4f315412d4445d69898f3f3f6c1216cf13ffba2c1b1cf45a9711f38890d02e1d",
            "path": "package.json"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-wp-viewer/MAL-2026-6571.json"