🛡️ MAL-2026-12189 — react-scroll-disable

Malicious code in react-scroll-disable (npm)

Source: amazon-inspector

On require of react-scroll-disable, the package's main entry executes an eval(atob(...)) blob appended after the legitimate RemoveScroll export. The blob loads child_process and http via \uXXXX-escaped identifiers, queries public Ethereum RPCs for the latest transaction to address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the transaction's to field into two IPv4 addresses, and issues GET/HEAD requests to those hosts on port 443 (paths /0x/cls and /0x/ls). The response carries an XOR-encrypted second-stage script in an x-payload-b64 header, which is decrypted and executed via spawn('node', ['-e', <payload>], {detached: true, stdio: 'ignore', windowsHide: true}).unref(), producing a detached child process running attacker-controlled code with no user interaction. The same payload is present in both dist/es2015 and dist/es2019 entry files. The attacker rotates the delivery IP by publishing new on-chain transactions, so the fetched code changes without any package update.