MAL-2026-12189
Dashboard / Malicious Package / MAL-2026-12189
MAL-2026-12189
Summary: Malicious code in react-scroll-disable (npm)
Details: Source: amazon-inspector (30e2eae248242fe92d777348542534e187d7773c2a092e8d3240d8bdd5b94afa) On require of react-scroll-disable, the package's main entry executes an eval(atob(...)) blob appended after the legitimate RemoveScroll export. The blob loads child_process and http via \uXXXX-escaped identifiers, queries public Ethereum RPCs for the latest transaction to address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the transaction's `to` field into two IPv4 addresses, and issues GET/HEAD requests to those hosts on port 443 (paths /0x/cls and /0x/ls). The response carries an XOR-encrypted second-stage script in an x-payload-b64 header, which is decrypted and executed via spawn('node', ['-e', <payload>], {detached: true, stdio: 'ignore', windowsHide: true}).unref(), producing a detached child process running attacker-controlled code with no user interaction. The same payload is present in both dist/es2015 and dist/es2019 entry files. The attacker rotates the delivery IP by publishing new on-chain transactions, so the fetched code changes without any package update.
Affected packages
Package
Name: react-scroll-disable
Purl: pkg:npm/react-scroll-disable
Affected ranges
Type: N/A
Events:
