Which versions of react-v17 are malicious?

The following npm versions of react-v17 are flagged malicious: 20.0.1. Treat any of these as compromised.

How do I remediate react-v17 if I installed it?

react-v17 is a typosquat — you almost certainly intended a legitimately-named package. Remove react-v17, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed react-v17 — how do I know if it already compromised me?

If react-v17 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is react-v17 part of a known attack campaign?

Yes — react-v17 is associated with the IN-MAL-2026-008252 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find react-v17 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for react-v17 (version 20.0.1).

Malicious package

react-v17npm

Advisory published Jul 8, 2026Updated Jul 8, 2026

react-v17 is a confirmed malicious npm package (MAL-2026-7020) that typosquats a legitimate package to trick installs (malicious version 20.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in react-v17 (npm)

MAL-2026-7020

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall react-v17

What this malware does

Package name 'react-v17' impersonates the legitimate 'react' package. package.json declares a preinstall hook 'node index.js' that auto-executes on npm install. index.js collects installer identity and host details (os.hostname(), os.userInfo(), os.platform/arch, home directory, cwd) and runs 'whoami' and 'id' via child_process.exec, then HTTPS POSTs the aggregate JSON to a hardcoded Burp Collaborator OOB endpoint at https://1jlay7gzya8akcmqs8repdf7oyupim6b.oastify.com/detox56. The tarball also ships an undeclared ~10.9 KB file 'i' next to index.js that is not referenced by package.json or index.js.

Malicious versions

1 flagged

20.0.1

Indicators of compromise (SHA-256)

73dab7161ffcaee5f943894308dd75428e9081b872daaed7ef50218bf98ad44a

Detection & response playbook

Typosquat

Find it
Search your lockfiles and build artifacts for react-v17 (version 20.0.1).
If you installed it — respond
react-v17 is a typosquat — you almost certainly intended a legitimately-named package. Remove react-v17, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If react-v17 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. react-v17 on npm has been identified as a malicious package (version 20.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-008252

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks react-v17-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database