Which versions of remactjs are malicious?

The following npm versions of remactjs are flagged malicious: 1.1.2, 1.1.4, 8.7.6. Treat any of these as compromised.

How do I remediate remactjs if I installed it?

Remove remactjs from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed remactjs — how do I know if it already compromised me?

If remactjs was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is remactjs part of a known attack campaign?

Yes — remactjs is associated with the RLMA-2026-05276, RLUA-2026-06437 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find remactjs across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for remactjs (3 malicious versions).

Malicious package

remactjsnpm

Advisory published Jul 7, 2026Updated Sep 1, 2026

remactjs is a confirmed malicious npm package (MAL-2026-7384) that executes malicious code on install (malicious versions 1.1.2, 1.1.4, 8.7.6). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in remactjs (npm)

MAL-2026-7384

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall remactjs

Malicious versions

3 flagged

1.1.21.1.48.7.6

Indicators of compromise (SHA-256)

6b3d227b8417a5bf1fcd12b43a0f10217ec7115a656f63b6441728d6f871024e

97fb659b4240c7c6e8e8f558568b726c9302bd98ca967cbbbad2fff6e53616f2

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for remactjs (3 malicious versions).
If you installed it — respond
Remove remactjs from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If remactjs was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. remactjs on npm has been identified as a malicious package (versions 1.1.2, 1.1.4, 8.7.6 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-05276RLUA-2026-06437

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks remactjs-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database