{"answers":{"affected":"1 open source package ship an affected version, including react-native-bright-sdk.","exploited":"There is no known exploitation of MAL-2026-18290 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-18290 is a malicious package in react-native-bright-sdk, published on 22 Oct 2026."},"fix_prompt":"MAL-2026-18290 is a malicious package: react-native-bright-sdk (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-18290/ (Markdown: https://insights.sbomify.com/MAL-2026-18290/index.md)","id":"MAL-2026-18290","markdown":"https://insights.sbomify.com/MAL-2026-18290/index.md","name":"MAL-2026-18290","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"react-native-bright-sdk 9000.0.0 is a dependency-confusion package that squats the name of a React Native SDK that is distributed privately as a tarball outside the npm registry. Its `preinstall` script runs `node canary.js`, which collects the machine's hostname and a timestamp, base64-encodes them and sends them in an HTTPS GET request to `https://estimator-nemeses-unwatched.ngrok-free.dev/canary` on install. The package describes itself as a \"namespace reservation / canary\" and contains no other functionality. The version number 9000.0.0 makes it outrank any private release of the same name in a project whose dependency resolution falls back to the public registry. The request does not read the response or set a timeout, so the install can hang. It was published on 2026-10-22, after an inert `0.0.0-stage` placeholder (not affected). Any machine that installed this version has disclosed its hostname to a third party; remove the package, and check that private package names are pinned to or scoped to the internal registry.\n\nThe package declares a preinstall lifecycle hook that executes canary.js on `npm install`. The script collects os.hostname() and an install timestamp, base64-encodes the JSON payload, and transmits it via HTTPS GET to the hardcoded endpoint https://estimator-nemeses-unwatched.ngrok-free.dev/canary. The destination is an anonymous, ephemeral ngrok tunnel unrelated to any legitimate publisher infrastructure, and the beacon fires automatically without user opt-in. The package ships no functional code justifying this network activity; it exists only to send the install signal. The version number (9000.0.0) and name resemble a dependency-confusion / namespace-reservation shape targeting internal package resolution.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in react-native-bright-sdk (npm)","id":"MAL-2026-18290","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"react-native-bright-sdk","purl":"pkg:npm/react-native-bright-sdk","source":"MAL-2026-18290"}],"products":null,"published":"2026-10-22","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-18290/"}