# pp-react-worldready-v5 (npm) malicious package — MAL-2026-12419 | O3 Security Malicious package # pp-react-worldready-v5npm Advisory published Aug 5, 2026·Updated Aug 5, 2026 pp-react-worldready-v5 is a confirmed malicious npm package (MAL-2026-12419) that steals credentials and exfiltrates sensitive data (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials. Malicious code in pp-react-worldready-v5 (npm) MAL-2026-12419 Immediate action Remove the package, then rotate any secrets the build/runtime could reach. npm uninstall pp-react-worldready-v5 ## What this malware does The tarball contains only package.json and vishu.js; the declared main (index.js) is absent, so the package has no library functionality. package.json.scripts.preinstall runs `node vishu.js`, which fires automatically on `npm install`. vishu.js resolves the installer's public IP via api.ipify.org, reads os.hostname() and GitHub Actions environment variables (CI, GITHUB\_ACTIONS, GITHUB\_WORKFLOW, GITHUB\_RUN\_ID, GITHUB\_RUN\_NUMBER, GITHUB\_RUN\_ATTEMPT), and sends them as query parameters in an HTTPS GET to [https://webhook.site/1b840cbf-f1a4-4d79-bf11-f1ef62949110](https://webhook.site/1b840cbf-f1a4-4d79-bf11-f1ef62949110). It also issues a DNS lookup for `ping-.your-collab-domain.oastify.com`, encoding the installer's hostname as a subdomain of a Burp Collaborator (OAST) host for out-of-band exfiltration. The package name resembles a typosquat pattern consistent with dependency-confusion reconnaissance. ## Malicious versions 1 flagged 1.0.0 ## Indicators of compromise (SHA-256) 435cbd5d4dffc9d7e61222051c82a376bf6dd5a484760803953484ea0fa21b39 ## Detection & response playbook Credential / info stealer 1. ### Find it Search your lockfiles and build artifacts for pp-react-worldready-v5 (version 1.0.0). 2. ### If you installed it — respond pp-react-worldready-v5 is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials. 3. ### Did it already run? If pp-react-worldready-v5 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward. ## Frequently asked questions No. pp-react-worldready-v5 on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree. ## Campaign IN-MAL-2026-014859 ## References - [npmjs.com](https://www.npmjs.com/package/pp-react-worldready-v5/v/1.0.0) ## Credits - Amazon Inspector · finder ## Detect & block this O3 blocks pp-react-worldready-v5\-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel. [Malware detection](/malware-detection) [Runtime egress monitoring](/egress-monitor) ## Explore [All malware advisories](/malware) [How O3 detects malware](/malware-database) [Vulnerability database](/vulnerability)