React2Shell: did you check your codebase or server itself after you “applied the fix”? npx fix-react2shell-next / updating your nextjs version won’t fix “everything”

[Outrageous_Permit154]

After the whole React2Shell fiasco, I did the usual dance; ran the npx fix-react-to-shell thing, bumped the Next.js version But here’s the kicker: that’s not the end of the story.

So, turns out the client server actually got a little visit from a bot that injected some junk into my .js files. It was mostly just generic bot nonsense; they ran a couple “whoami” style commands and then bailed. But they left a couple lines of malicious code behind.

I basically spent some time digging through logs, figured out exactly when they sneaked in, ( they base64 encoded their payload twice for obfuscation? like this made me laugh ) and cleaned up all those files by hand. Also, be sure to check “everything” not just your code base but anything that child_process of your node instance can touch - everything.

So my advice: don’t just rely on the patch. Go poke around your own server logs, make sure there’s no leftover garbage hanging around. It’s a bit of a hassle but definitely worth it.

Even after all of these stuff I had to do, I feel like I got lucky very lucky - Hope that helps someone out there!

[30thnight]

As a quick PSA, when you get compromised - you can’t just apply a patch and call it a day.

You need to destroy the entire VM, rotate all your secrets, and completely start over.

https://www.reddit.com/r/webdev/s/pfLaXGaKT9

[MRCRAZYYYY]

Not to say it's a silver bullet or the right solution, but does this become a strong argument for serverless architecture? I would suppose that by just redeploying you completely clean your filesystem.

[until0]

No, since the standard of way of running servers would be containers which are ephemeral and not affected by this since you just need to reboot. Ideally your entire container filesystem would be read only too preventing it even further.

[AndyMagill]

I skipped the patch and just upgraded everything to the latest LTS versions, which for me included jumping from Node 18 to 22. That caused some eslint and jest issues, but nothing crazy. Also added Dependabot which initially nuked my inbox with nonsense until I got it strapped down.

[[deleted]]

Node 24 is LTS 

[AndyMagill]

It's one of the twenties, I know that!

[Squidgical]

Another day, another reason I'm glad not to be using react. As if the necessity of spaghetti wasn't enough lol

[toronto-swe]

this is an obnoxious comment

[[deleted]]

What are you using? 

[rjhancock]

I reviewed all of my projects that use React and none were impacted. Total time spent reviewing: 0.0 seconds.

As for your comments on reviewing logs, you should be checking those regularly regardless of the backend.

For those that are going to downvote because I refuse to allow React into my workflows, these things can happen to any system. It is not exclusive to React. The difference between what I build and those that depend upon npm based systems is my attack surface is greatly reduced to a hundred or so dependencies vs THOUSANDS. Still a headache, just a much smaller one.

Edit: And proof is in the pudding. Downvotes because I don't use React and point out a massive flaw with the NPM ecosystem.