Suspicious 85% javascript Download

react-icons-svgo 1.0.0

Obfuscated install hook executes malicious npm command

“A lightweight React utility for fetching, validating, and managing SVG icons from CDN sources.”

Anomalous package runs an obfuscated install hookCalls svg tool getPlugin
SHA-256f7fcb551ad78d9c1ba6183b83073b1297fffe7cb610f92c1820146712a897405
URLhttps://registry.npmjs.org/react-icons-svgo/-/react-icons-svgo-1.0.0.tgz
MaleculeK(Mc)O(S₄)H₄(CmDbFPo₄)Md₂(Pa₄)

Also flagged by osv (MAL-2026-10482: Malicious code in react-icons-svgo (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.