Supply chain · npm · High

Critical npm Package 'react-dynammic-table-component' Leads to Full Compromise

Threat Engine Auto-Feed · data current as of 2026-07-13

A malicious version of the 'react-dynammic-table-component' npm package has been identified, leading to full system compromise upon installation. All secrets and keys on affected systems must be rotated immediately, and the package removed, though full remediation may require further steps due to potential persistent access.

  • Package: npm / react-dynammic-table-component
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~62/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'react-dynammic-table-component' contains malware. Installation of this package results in a complete compromise of the host system, granting an attacker full control.

How the attack works

This is a supply-chain attack where a seemingly legitimate software package is trojanized with malicious code. When the package is installed as a dependency, the malicious code executes, establishing unauthorized access and control over the compromised system. The specific mechanism involves credential and secret theft.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that automatically pull package dependencies
  • Any user or system that has installed 'react-dynammic-table-component'

Conditions that increase exposure

  • Unpinned dependencies in package.json allowing installation of the latest (malicious) version
  • Lack of package-lock.json or yarn.lock files to ensure consistent dependency versions
  • Use of internal package mirrors that may not have filtered out the malicious package
  • Automated build processes that install dependencies without manual review

Blast-radius scenarios

  • An attacker gains full control over the compromised computer.
  • All secrets and keys stored on the compromised computer are exfiltrated.
  • The attacker can establish persistence, making simple package removal insufficient for remediation.
  • The compromised system can be used as a pivot point for further attacks within the network.

What to do (defensive)

Detect

  • Identify all instances where 'react-dynammic-table-component' is listed as a dependency in package.json files.
  • Scan build logs and dependency trees for evidence of 'react-dynammic-table-component' installation.
  • Monitor network traffic for unusual outbound connections from systems that installed the package.
  • Review system logs for suspicious process execution or file modifications on affected machines.

Contain

  • Immediately isolate any system identified as having installed 'react-dynammic-table-component' from the network.
  • Block network access to known malicious domains or IPs associated with the attack (if available).
  • Suspend any CI/CD pipelines that might be installing this package.
  • Prevent further installation of 'react-dynammic-table-component' by blocking it in package registries or proxies.

Remediate

  • Consider any computer that installed 'react-dynammic-table-component' to be fully compromised.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, access tokens) stored on affected computers, performing this action from a different, trusted computer.
  • Remove the 'react-dynammic-table-component' package from all affected systems.
  • Perform a full forensic analysis of compromised systems to identify the extent of the breach and any persistent malicious software.
  • Rebuild compromised systems from trusted images if forensic analysis cannot guarantee full eradication of the threat.

Frontier verdict — High

This critical npm package compromise requires immediate isolation, secret rotation, and thorough remediation due to full system takeover.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.