Supply chain · npm · High
Malicious npm package 'pp-react-worldready' identified, communicates with malicious domain
Threat Engine Auto-Feed · data current as of 2026-08-02
The npm package 'pp-react-worldready' version 1.0.0 has been identified as malicious due to its communication with a known malicious domain. Organizations using this package are exposed to potential data exfiltration or further compromise, necessitating immediate detection and remediation.
- Package: npm / pp-react-worldready
- Affected versions: = 1.0.0
- Severity: critical
- Reach: ~173/wk
- Exposure: 70/100 (High)
What happened — Malicious package
The npm package 'pp-react-worldready' version 1.0.0 was identified by the OpenSSF Package Analysis project as malicious. The primary indicator of malicious activity is the package's communication with a domain associated with known malicious operations.
How the attack works
This type of attack involves an attacker publishing a seemingly legitimate software package to a public registry. When installed and executed, the malicious code within the package performs unauthorized actions, such as establishing network connections to attacker-controlled infrastructure, potentially for data exfiltration or to receive further instructions.
Who's exposed
Profiles most at risk
- Development teams using the npm ecosystem
- Organizations whose CI/CD pipelines pull unpinned or latest versions of dependencies
- Any project that directly or indirectly depends on 'pp-react-worldready' version 1.0.0
Conditions that increase exposure
- Unpinned dependency versions in package.json allowing installation of '1.0.0'
- Lack of a lockfile (e.g., package-lock.json) to ensure consistent dependency resolution
- Use of internal mirrors that may not have updated their blocklists or removed the malicious package
- Automated build processes that install dependencies without prior security scanning
Blast-radius scenarios
- If installed, the package could establish outbound connections to a malicious domain, potentially exfiltrating sensitive data or downloading additional payloads.
- An attacker could gain initial access to development environments or build systems, leading to further lateral movement within the organization's network.
- Compromised build artifacts could propagate the malicious behavior downstream to end-users or production systems.
What to do (defensive)
Detect
- Scan dependency trees for 'pp-react-worldready' version 1.0.0 using software composition analysis (SCA) tools.
- Monitor network traffic for outbound connections from build systems or applications to known malicious domains.
- Review package-lock.json or yarn.lock files for the presence of the affected package.
Contain
- Immediately block 'pp-react-worldready' version 1.0.0 in your private npm registries or proxy servers.
- Isolate any systems or environments where 'pp-react-worldready' version 1.0.0 was installed or executed.
- Temporarily halt builds that depend on public npm registries until remediation steps are complete.
Remediate
- Remove 'pp-react-worldready' version 1.0.0 from all project dependencies.
- Force a clean re-installation of dependencies after updating package manifests to remove the malicious package.
- Rotate credentials and API keys that may have been exposed on compromised build systems or development machines.
- Implement strict dependency pinning and use lockfiles to prevent future installation of unvetted package versions.
Frontier verdict — High
Prioritize immediate detection and removal of 'pp-react-worldready' version 1.0.0 due to its critical severity and communication with a malicious domain.
Sources
For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.