Search code examples
reactjssecuritynpmreact-dom

I accidentally did an npm install on reacct-dom instead of react-dom. What should I do?

I tried running the command

npm install react react-dom

But I ended up typing

npm install react reacct-dom

When I was getting errors, I went back and sure enough found my mistake. I promptly deleted the packages using:

npm un react reacct-dom

But I am worried I might have downloaded something malicious that is persistent. What should I do to be sure?

When I looked up npm reacct-dom I found this website:

https://www.npmjs.com/~arch.lin?activeTab=packages

Upon looking at this guys packages he has many that are typos of reacct-dom.

screenshot of npmjs.com showing packages by arch.lin, most of which say "Security placeholder"

Again I uninstalled the package using npm un react reacct-dom. I don't know if I could still be in danger of malware.

Solution

  • No, you are not in any danger of being hacked. Looking at the codetab you can see there are no js files or any other executables for that matter.

    Code tab

    No files are suspiciously large another good sign. And none of the file seem to contain anything malicious.

    If you want to be extra sure nothing is on your system run npm cache-clean --force to clear all cached files by npm.