MAL-2026-6547

Dashboard / Malicious Package / MAL-2026-6547

MAL-2026-6547

Summary: Malicious code in react-editable-calendar (npm)

Details: Source: amazon-inspector (ef4c5725bd98fb80c8dc59c58f68627b6a69aa4c4ae16d3f0c70c011895144cb) package.json declares a preinstall hook `node src/utils/index.d.js`, but the published tarball's `files` whitelist ships only `dist/`, `README.md`, and `LICENSE` — `src/utils/index.d.js` is not present, so `npm install` will fail with ENOENT before any package code executes. No exfiltration, dropper, or attacker-controlled network destination is reachable in the shipped artifact. Separately, the published name `react-editable-calendar` does not match the library's documented identity (`schedulaforge`, exporting a `SchedulaForge` class) and the package contains no React-specific code; the chosen name appears positioned to attract developers searching for a React calendar component. Together these signals — a dangling preinstall pointer to a non-shipped script in a headless library, plus a name/identity mismatch — are atypical enough to warrant human review of the maintainer's intent, but the artifact as published does not harm installers. Source: ossf-package-analysis (861d1a7aff6fd0e70699aedba04e28c0af286ad7c07d64a48bfbecdb54dbdcf2) The OpenSSF Package Analysis project identified 'react-editable-calendar' @ 0.1.7 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

References: https://www.npmjs.com/package/react-editable-calendar/v/0.1.7, https://www.npmjs.com/package/react-editable-calendar/v/0.1.0, https://www.npmjs.com/package/react-editable-calendar/v/0.1.1, https://www.npmjs.com/package/react-editable-calendar/v/0.1.2, https://www.npmjs.com/package/react-editable-calendar/v/0.1.4, https://www.npmjs.com/package/react-editable-calendar/v/0.1.3, https://www.npmjs.com/package/react-editable-calendar/v/0.1.6