MAL-2026-12189 Malicious code in react-scroll-disable (npm)
Malicious package
Published
MAL-2026-12189 is a malicious package: react-scroll-disable (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-12189/ (Markdown: https://insights.sbomify.com/MAL-2026-12189/index.md)
- Package
- react-scroll-disable
- Registry
- npm
What is MAL-2026-12189?
MAL-2026-12189 is a malicious package in react-scroll-disable, published on 5 Aug 2026.
Official description
On require of react-scroll-disable, the package's main entry executes an eval(atob(…)) blob appended after the legitimate RemoveScroll export. The blob loads child_process and http via \uXXXX-escaped identifiers, queries public Ethereum RPCs for the latest transaction to address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the transaction's
to field into two IPv4 addresses, and issues GET/HEAD requests to those hosts on port 443 (paths /0x/cls and /0x/ls). The response carries an XOR-encrypted second-stage script in an x-payload-b64 header, which is decrypted and executed via spawn('node', ['-e', <payload>], {detached: true, stdio: 'ignore', windowsHide: true}).unref(), producing a detached child process running attacker-controlled code with no user interaction. The same payload is present in both dist/es2015 and dist/es2019 entry files. The attacker rotates the delivery IP by publishing new on-chain transactions, so the fetched code changes without any package update.What should I do about MAL-2026-12189?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.