MAL-2026-6410 Malicious code in @su-doughnym/react-dlb (npm)

Package self-identifies as a dependency-confusion bug-bounty proof-of-concept and is published at version 99.99.99 to win resolution priority over an internal package of the same name. The shipped postinstall script (postinstall.js lines 11-13) only reads os.hostname(), os.userInfo().username, process.version, and process.pid and prints them to stdout — no network call, no file write, no credential read, no remote fetch. The current tarball therefore does not exfiltrate or execute attacker-controlled bytes on the installer. The risk is that any organization whose internal package resolution accidentally pulls @su-doughnym/react-dlb instead of an internal package of the same name will execute this author's lifecycle scripts, and a future version under the same name+scope could replace the harmless beacon with a weaponized payload.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.