Which versions of react-hook-scripts are malicious?

The following npm versions of react-hook-scripts are flagged malicious: 5.4.2. Treat any of these as compromised.

How do I remediate react-hook-scripts if I installed it?

react-hook-scripts is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed react-hook-scripts — how do I know if it already compromised me?

If react-hook-scripts was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is react-hook-scripts part of a known attack campaign?

Yes — react-hook-scripts is associated with the IN-MAL-2026-010684 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find react-hook-scripts across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for react-hook-scripts (version 5.4.2).

Malicious package

react-hook-scriptsnpm

Advisory published Jul 15, 2026Updated Jul 15, 2026

react-hook-scripts is a confirmed malicious npm package (MAL-2026-10684) that steals credentials and exfiltrates sensitive data (malicious version 5.4.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in react-hook-scripts (npm)

MAL-2026-10684

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall react-hook-scripts

What this malware does

The package's default export getPlugin fetches a JSON document from the hardcoded endpoint https://svganchordev.net/icons/108 and passes the returned credits field to new Function('require','module','exports',...,'Promise', data.credits), executing the server-supplied string as JavaScript with full Node.js globals (require, process, Buffer) available. The remote URL is assembled by concatenating protocol/separator/domain/path fragments and the request is framed with an bearrtoken: "logo" header and an icon-retrieval path, disguising a remote code loader as an SVG helper despite the package's advertised role as a React/SVG utility. Declared dependencies (@primno/dpapi for Windows DPAPI decryption, better-sqlite3, node-machine-id) are consistent with a credential and host-fingerprint stealer stage delivered by the fetched payload. Any caller of the advertised API triggers execution of arbitrary attacker-controlled code on the installer's host, and the payload can be changed server-side at any time.

Malicious versions

1 flagged

5.4.2

Indicators of compromise (SHA-256)

52d4b717c5de5139b732e16ea9eca2654947ecf17e919334a6dd039c5b60e059

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for react-hook-scripts (version 5.4.2).
If you installed it — respond
react-hook-scripts is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If react-hook-scripts was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. react-hook-scripts on npm has been identified as a malicious package (version 5.4.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-010684

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks react-hook-scripts-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database