Is react-bootstrap-table2-toolkit-bg malicious?
Yes. Protet confirmed 1 version of react-bootstrap-table2-toolkit-bg as malicious
First confirmed on 2026-11-07.
Affected versions
| Version | Confirmed | Protet record |
|---|---|---|
| 9.9.9 | 2026-11-07 | PROTET-NPM-2026-166 |
What it does
A dependency-confusion package published 2026-11-07 under the name react-bootstrap-table2-toolkit-bg with the inflated version 9.9.9 to win resolution over a private package. Both its preinstall and postinstall hooks run 'node beacon.js', which sends the machine's hostname, user name, current working directory and platform as query parameters of a cleartext HTTP GET to the hardcoded endpoint http://100.24.177.136/cb. Self-described as an authorized dependency-confusion proof of concept. Remove the package and treat the hostnames, user names and paths of affected build machines as disclosed.
Other reports
- Also reported in OSV as MAL-2026-18799
What to do if you installed it
- Remove the package from every project that uses it, directly or through another dependency.
- Pin a clean version if you need the package: one that is not listed above and that you have checked yourself, or replace the package. A version missing from this page is not cleared.
- Check your lockfiles (
package-lock.json,yarn.lock,pnpm-lock.yaml) for the affected versions, including as a transitive dependency, and in CI caches. - Rotate credentials that were reachable from any machine or build that installed it: npm and GitHub tokens, cloud keys, SSH keys, and secrets in environment variables or CI settings.
Status history
- 2026-11-07: 9.9.9 named by Protet Intel