MAL-2026-17777

    Dashboard / Malicious Package / MAL-2026-17777

    MAL-2026-17777

    Published: 11 Oct 2026Last Modified: 11 Oct 2026

    Summary: Malicious code in react-paginate-v5 (npm)

    Details: Source: amazon-inspector (2c0f91fe35323a6f47033b90ebaf88498a36fd7e8e933711b2cf301dba2e4759) [email protected] is a dependency-confusion probe published under a name resembling the popular react-paginate package and pinned to an implausibly high version (99.0.0) to win resolution against an internal package. Its package.json declares a preinstall lifecycle script that runs `nslookup dep-confusion-poc.2chsn9exkdupkr3cxed7vp7sk.canarytokens.com`, which fires automatically on `npm install` and emits a DNS query from the installer's resolver to an attacker/researcher-controlled canary subdomain. The subdomain label (`dep-confusion-poc`) self-identifies the operation as a dependency-confusion test. The DNS lookup confirms successful installation to the operator of the canary token, identifying hosts and networks where an internal package name was shadowed by this public squat. While the beacon itself only exfiltrates the fact of installation plus resolver metadata, the same install-time execution primitive can carry any shell command, and the package has no legitimate functionality.

    References: https://www.npmjs.com/package/react-paginate-v5/v/99.0.0

    Affected packages

    Package

    Name: react-paginate-v5

    Purl: pkg:npm/react-paginate-v5

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.0