react-dom@19.3.1 is the legitimate React DOM package. The flagged patterns (\ x3c, \ u0073 escapes, long minified strings, btoa() references, and descriptive variable names) are all benign: they come from HTML/script escaping in SSR, regex/attribute handling, and minified production builds. No malicious behavior present.
AI breakdown
Plain-English summary of what this package does and how it behaves.
Official React package for DOM interactions. Provides client and server rendering, profiling, and test utilities for React apps; depends on the scheduler package.
Capabilities
- Provides DOM client rendering
- Supports server-side rendering
- Includes profiling and test utilities
- Supports multiple runtimes (browser, node, edge, bun)
Data access
- None observed
Network
- No network access observed
Widely used official React library with many minified production files flagged as obfuscated (expected for builds); no scripts, network, or sensitive data access observed in manifest.
Dependency & execution chain
Every package this one pulls in, colored by verdict. Expand to walk the tree.
Security findings (24)
Static analysis rule matches, with the exact code that triggered them.
Multiple obfuscation patterns in cjs/react-dom-server-legacy.browser.development.js
Multiple obfuscation patterns in package/cjs/react-dom-server-legacy.browser.development.js
Multiple obfuscation patterns in cjs/react-dom-server-legacy.browser.production.js
Multiple obfuscation patterns in package/cjs/react-dom-server-legacy.browser.production.js
Multiple obfuscation patterns in cjs/react-dom-server-legacy.node.development.js
Multiple obfuscation patterns in package/cjs/react-dom-server-legacy.node.development.js
Multiple obfuscation patterns in cjs/react-dom-server-legacy.node.production.js
Multiple obfuscation patterns in package/cjs/react-dom-server-legacy.node.production.js
Multiple obfuscation patterns in cjs/react-dom-server.browser.development.js
Multiple obfuscation patterns in package/cjs/react-dom-server.browser.development.js
Multiple obfuscation patterns in cjs/react-dom-server.browser.production.js
Multiple obfuscation patterns in package/cjs/react-dom-server.browser.production.js
Multiple obfuscation patterns in cjs/react-dom-server.bun.development.js
Multiple obfuscation patterns in package/cjs/react-dom-server.bun.development.js
Multiple obfuscation patterns in cjs/react-dom-server.bun.production.js
Multiple obfuscation patterns in package/cjs/react-dom-server.bun.production.js
Multiple obfuscation patterns in cjs/react-dom-server.edge.development.js
Multiple obfuscation patterns in package/cjs/react-dom-server.edge.development.js
Multiple obfuscation patterns in cjs/react-dom-server.edge.production.js
Multiple obfuscation patterns in package/cjs/react-dom-server.edge.production.js
Multiple obfuscation patterns in cjs/react-dom-server.node.development.js
Multiple obfuscation patterns in package/cjs/react-dom-server.node.development.js
Multiple obfuscation patterns in cjs/react-dom-server.node.production.js
Multiple obfuscation patterns in package/cjs/react-dom-server.node.production.js
Files in package (78)
How ShadowCanopy checks npm packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/react-dom