Supply chain · npm · High

Malicious npm package 'pp-react-worldready' identified, communicates with malicious domain

Threat Engine Auto-Feed · data current as of 2026-08-02

The npm package 'pp-react-worldready' version 1.0.0 has been identified as malicious due to its communication with a known malicious domain. Organizations using this package are exposed to potential data exfiltration or further compromise, necessitating immediate detection and remediation.

  • Package: npm / pp-react-worldready
  • Affected versions: = 1.0.0
  • Severity: critical
  • Reach: ~173/wk
  • Exposure: 70/100 (High)

What happened — Malicious package

The npm package 'pp-react-worldready' version 1.0.0 was identified by the OpenSSF Package Analysis project as malicious. The primary indicator of malicious activity is the package's communication with a domain associated with known malicious operations.

How the attack works

This type of attack involves an attacker publishing a seemingly legitimate software package to a public registry. When installed and executed, the malicious code within the package performs unauthorized actions, such as establishing network connections to attacker-controlled infrastructure, potentially for data exfiltration or to receive further instructions.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations whose CI/CD pipelines pull unpinned or latest versions of dependencies
  • Any project that directly or indirectly depends on 'pp-react-worldready' version 1.0.0

Conditions that increase exposure

  • Unpinned dependency versions in package.json allowing installation of '1.0.0'
  • Lack of a lockfile (e.g., package-lock.json) to ensure consistent dependency resolution
  • Use of internal mirrors that may not have updated their blocklists or removed the malicious package
  • Automated build processes that install dependencies without prior security scanning

Blast-radius scenarios

  • If installed, the package could establish outbound connections to a malicious domain, potentially exfiltrating sensitive data or downloading additional payloads.
  • An attacker could gain initial access to development environments or build systems, leading to further lateral movement within the organization's network.
  • Compromised build artifacts could propagate the malicious behavior downstream to end-users or production systems.

What to do (defensive)

Detect

  • Scan dependency trees for 'pp-react-worldready' version 1.0.0 using software composition analysis (SCA) tools.
  • Monitor network traffic for outbound connections from build systems or applications to known malicious domains.
  • Review package-lock.json or yarn.lock files for the presence of the affected package.

Contain

  • Immediately block 'pp-react-worldready' version 1.0.0 in your private npm registries or proxy servers.
  • Isolate any systems or environments where 'pp-react-worldready' version 1.0.0 was installed or executed.
  • Temporarily halt builds that depend on public npm registries until remediation steps are complete.

Remediate

  • Remove 'pp-react-worldready' version 1.0.0 from all project dependencies.
  • Force a clean re-installation of dependencies after updating package manifests to remove the malicious package.
  • Rotate credentials and API keys that may have been exposed on compromised build systems or development machines.
  • Implement strict dependency pinning and use lockfiles to prevent future installation of unvetted package versions.

Frontier verdict — High

Prioritize immediate detection and removal of 'pp-react-worldready' version 1.0.0 due to its critical severity and communication with a malicious domain.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.