Fallout

The latest malware caught across open-source registries and marketplaces — evidence included.

Crit

Ecosystem

Domain

Confirmed

react-icons-svgo 1.5.3 A lightweight React utility for fetching, validating, and managing SVG icons from CDN sources. Jun 27 javascript

46ecdd04fbdc2f905d1aa9358b5deec7e7c49de1bd65447710f60fbc0db0ab40 ✓ K(Mc)O(S₄)H₄(CmDbFPo₄)Md₂(Pa₄)

100% Obfuscated install hook installs malicious plugin

react-icons-svgo 1.0.0 A lightweight React utility for fetching, validating, and managing SVG icons from CDN sources. Jun 27 javascript

f7fcb551ad78d9c1ba6183b83073b1297fffe7cb610f92c1820146712a897405 ✓ K(Mc)O(S₄)H₄(CmDbFPo₄)Md₂(Pa₄)

85% Obfuscated install hook executes malicious npm command