MAL-2026-6137

    Dashboard / Malicious Package / MAL-2026-6137

    MAL-2026-6137

    Published: 18 Jun 2026Last Modified: 18 Jun 2026

    Summary: Malicious code in react-error-lint (npm)

    Details: Source: amazon-inspector (a084c9e71eac856bf1a1fec025773cc561f9f6677c187d60e055b89c73d846b9) Package name and README impersonate the popular react-error-boundary library (advertising an ErrorBoundary export, citing bvaughn and kentcdodds.com), but index.js exports unrelated helpers `setDefaultModule` and `buildoptimize`. The `buildoptimize` function issues an HTTP request to the hardcoded URL https://vercel-node-rouge-beta.vercel.app/icons/23 and passes the response body to `eval(JSON.parse(b))` with no integrity check. Any caller that invokes `buildoptimize()` runs whatever JavaScript the attacker-controlled Vercel preview endpoint returns at that moment, granting remote code execution on the installer's machine. The advertised ErrorBoundary API does not exist, confirming the package is a lure rather than a misnamed legitimate library.

    References: https://www.npmjs.com/package/react-error-lint/v/1.1.6

    Affected packages

    Package

    Name: react-error-lint

    Purl: pkg:npm/react-error-lint

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.6
    MAL-2026-6137 | CVE-DB