MAL-2026-17758 — Malicious code in react-dropzone-v4 (npm)

OpenSSF Package Analysis identified react-dropzone-v4 version 99.0.0 as malicious. The package mimics the popular react-dropzone library, and its only install-time effect is an out-of-band beacon that transmits the installer's hostname.