MAL-2026-14355

    Dashboard / Malicious Package / MAL-2026-14355

    MAL-2026-14355

    Published: 21 Aug 2026Last Modified: 21 Aug 2026

    Summary: Malicious code in fuel-react (npm)

    Details: Source: amazon-inspector (8e35f4772b8cba3555519c250662c67395bf57d89feed3feba7ea067b6bb2c27) The package's postinstall.js script executes automatically on npm install and collects host identity plus environment variables (os.hostname(), process.env) and transmits them via an https request. The package name mimics common React tooling but the shipped install-time behavior is host reconnaissance and environment-variable exfiltration, which frequently captures credentials such as npm tokens, CI secrets, and cloud keys present in process.env.

    References: https://www.npmjs.com/package/fuel-react/v/91.0.0

    Affected packages

    Package

    Name: fuel-react

    Purl: pkg:npm/fuel-react

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    91.0.0