MAL-2026-1040

    Dashboard / Malicious Package / MAL-2026-1040

    MAL-2026-1040

    Published: 23 Feb 2026Last Modified: 4 Mar 2026

    Summary: Malicious code in react-markdown-canvas (npm)

    Details: Malicious package due to data exfiltration via Discord webhook on install. Collects IP, hostname, and date without consent. Source: amazon-inspector (4123db6526d8c37f99fa33e2524edc97922efef6b1605dc0a8acdbf41e76cc77) The package react-markdown-canvas was found to contain malicious code. Source: ossf-package-analysis (833c2865c0a6f984f9af493aa02b5ec03e8a63f037c298a46ae54bb1d88d3a1a) The OpenSSF Package Analysis project identified 'react-markdown-canvas' @ 1001.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References: https://app.safedep.io/community/malysis/01KJ69FH2YT5GPF37JYK3T87DN

    Affected packages

    Package

    Name: react-markdown-canvas

    Purl: pkg:npm/react-markdown-canvas

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1001.0.0
    MAL-2026-1040 | CVE-DB