Supply chain · npm · High

Critical Typosquatting: Malicious @tunstock/remact-dom npm Package Exfiltrates Data

Threat Engine Auto-Feed · data current as of 2026-10-09

The npm package `@tunstock/remact-dom` version 19.2.0 is a typosquatting attack impersonating `react-dom`. It contains a post-install script that automatically exfiltrates system and project information to an attacker-controlled domain, posing a critical supply-chain risk for npm users.

  • Package: npm / @tunstock/remact-dom
  • Affected versions: = 19.2.0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Typosquatting

The malicious npm package `@tunstock/remact-dom` version 19.2.0 was published as a typosquat of the legitimate `react-dom` package. Upon installation, a post-install script automatically executes, collecting sensitive system and project data. This collected data is then transmitted to a hardcoded, lookalike domain (`tele.metry.orgin.net`), misrepresenting the package's identity as `react-dom` version 19.2.0.

How the attack works

This is a typosquatting attack where a malicious package mimics a popular legitimate one to trick developers into installing it. The attack leverages an automatic post-install script to execute reconnaissance. This script gathers system identifiers (hostname, OS, architecture, Node version, public IP, current working directory) and project details (package.json name and version). This information is then exfiltrated to an external, non-legitimate server, likely for victim tagging and staging further attacks.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines configured to pull the latest versions of dependencies
  • Organizations with developers who might mistype package names during installation

Conditions that increase exposure

  • Projects with unpinned dependencies that could inadvertently pull the malicious version
  • Lack of `package-lock.json` or `npm-shrinkwrap.json` to ensure consistent dependency versions
  • Use of internal package mirrors that may not filter out malicious packages

Blast-radius scenarios

  • An attacker gains reconnaissance data about development environments, including system details and project identifiers, which can be used to tailor subsequent, more targeted supply-chain attacks.
  • The exfiltrated data could be used to identify potential high-value targets within an organization for further compromise.

What to do (defensive)

Detect

  • Scan `package.json` and `package-lock.json` files for `@tunstock/remact-dom` version 19.2.0.
  • Monitor network traffic for connections to `tele.metry.orgin.net` or other suspicious domains from build environments or developer machines.
  • Implement software composition analysis (SCA) tools to identify known malicious packages and typosquats.

Contain

  • Immediately quarantine any systems or build environments found to have installed `@tunstock/remact-dom` version 19.2.0.
  • Block network access to `tele.metry.orgin.net` at the firewall level.
  • Review and update `package.json` files to use exact version pinning for all dependencies, especially for critical packages.

Remediate

  • Remove `@tunstock/remact-dom` from all `package.json` and `package-lock.json` files.
  • Replace any references to `@tunstock/remact-dom` with the legitimate `react-dom` package.
  • Force a full rebuild of all affected projects after dependency updates to ensure the malicious package is purged.
  • Rotate any credentials or API keys that might have been exposed or used on compromised systems, as the reconnaissance could precede further attacks.

Frontier verdict — High

Prioritize immediate detection and removal of `@tunstock/remact-dom` due to critical severity and automatic data exfiltration.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.