Protet Intel / npm / react-bootstrap-table-next-bg
react-bootstrap-table-next-bg 9.9.9
confirmed malicious
PROTET-NPM-2026-165
Every version of this package that Protet Intel names: Is react-bootstrap-table-next-bg malicious?
Details
A dependency-confusion package published 2026-11-07 under the name react-bootstrap-table-next-bg with the inflated version 9.9.9 to win resolution over a private package. Both its preinstall and postinstall hooks run 'node beacon.js', which sends the machine's hostname, user name, current working directory and platform as query parameters of a cleartext HTTP GET to the hardcoded endpoint http://100.24.177.136/cb. Self-described as an authorized dependency-confusion proof of concept. Remove the package and treat the hostnames, user names and paths of affected build machines as disclosed.
Records
- OSV record PROTET-NPM-2026-165
- Also reported in OSV as MAL-2026-18798
- Feeds: NDJSON, Atom
Status history
- 2026-11-07: named as a Protet finding
- 2026-11-10: active