react-next-dom @17.2.8

Summary

react-next-dom masquerades as a React/Next.js ecosystem package but ships a pino-like surface concealing a remote code loader. The main export is a middleware factory that, when invoked, spawns node./lib/caller.js as a detached, stdio-ignored child process ( spawn("node", [script,...], { detached: true, stdio: "ignore" }); child.unref() ). lib/caller.js then fetches a JavaScript payload from https://jsonkeeper.com/b/D3GLF (using an x-secret-key header), and evaluates the response body in the host Node.js process via new Function.constructor("require", s)(require) , retrying up to 5 times. Additional payload URLs (https://jsonkeeper.com/b/XRGF3, https://jsonkeeper.com/b/4NAKK) are hidden as base64 blobs disguised as DEV_API_KEY constants in lib/caller.js and lib/const.js. jsonkeeper.com is an anonymous public paste service — content is attacker-mutable, and the executed code runs with full require access, giving the operator arbitrary code execution on any host that loads this package's middleware. The package name evokes react/react-dom/next.js while the shipped code impersonates pino (keywords fast , logger , stream , json ; files pino.js , transport, multistream, redaction; module.exports.pino = middleware ), a typosquat/impersonation cover for the loader.

Source: amazon-inspector (8e7369fd2dd1ba9002d2c693ba08c553c7c6fef54dba372146c11f20b43607aa)