I tried running the command
npm install react react-dom
But I ended up typing
npm install react reacct-dom
When I was getting errors, I went back and sure enough found my mistake. I promptly deleted the packages using:
npm un react reacct-dom
But I am worried I might have downloaded something malicious that is persistent. What should I do to be sure?
When I looked up npm reacct-dom I found this website:
.lin?activeTab=packages
Upon looking at this guys packages he has many that are typos of reacct-dom.
Again I uninstalled the package using npm un react reacct-dom. I don't know if I could still be in danger of malware.
I tried running the command
npm install react react-dom
But I ended up typing
npm install react reacct-dom
When I was getting errors, I went back and sure enough found my mistake. I promptly deleted the packages using:
npm un react reacct-dom
But I am worried I might have downloaded something malicious that is persistent. What should I do to be sure?
When I looked up npm reacct-dom I found this website:
https://www.npmjs/~arch.lin?activeTab=packages
Upon looking at this guys packages he has many that are typos of reacct-dom.
Again I uninstalled the package using npm un react reacct-dom. I don't know if I could still be in danger of malware.
- Well you can open the "Code" tab of the package you accidentally downloaded, check whats inside, check its package.json file to see what else was downloaded as subdependencies. I checked few of the packages from this user and all of them were empty, without any code or any subdependencies. – Sergey Sosunov Commented Feb 16 at 1:03
2 Answers
Reset to default 0No, you are not in any danger of being hacked. Looking at the codetab you can see there are no js files or any other executables for that matter.
No files are suspiciously large another good sign. And none of the file seem to contain anything malicious.
If you want to be extra sure nothing is on your system run npm cache-clean --force to clear all cached files by npm.
While reacct-dom does not currently have malicious code, the fact that such a package was published just to exploit a potential typo is suspicious and is usually called a typosquatting attack.
You can use vet to inspect a single package before installing. We do have plans to hook into npm or similar package manager workflow to do this automatically.
Full Disclosure: Developer of vet here.