Official react-dom package. The flagged patterns (\ x3c, \ u0073 escapes + long internal vars) are from legitimate script/style sanitizers and React's own SSR code, not obfuscation or malice.
AI breakdown
Plain-English summary of what this package does and how it behaves.
Official React package for working with the DOM. Provides client and server rendering APIs for React components across browser, Node, Edge, and other environments.
Capabilities
- Renders React components to DOM
- Supports server-side rendering
- Includes profiling and test utilities
- Provides environment-specific builds (browser, node, edge, bun)
Data access
- None observed
Network
- No network access observed
This is the standard react-dom library with a single dependency on scheduler. Multiple files are flagged as obfuscated, consistent with minified production builds in the official package.
Dependency & execution chain
Every package this one pulls in, colored by verdict. Expand to walk the tree.
Security findings (24)
Static analysis rule matches, with the exact code that triggered them.
Multiple obfuscation patterns in cjs/react-dom-server-legacy.browser.development.js
Multiple obfuscation patterns in package/cjs/react-dom-server-legacy.browser.development.js
Multiple obfuscation patterns in cjs/react-dom-server-legacy.browser.production.js
Multiple obfuscation patterns in package/cjs/react-dom-server-legacy.browser.production.js
Multiple obfuscation patterns in cjs/react-dom-server-legacy.node.development.js
Multiple obfuscation patterns in package/cjs/react-dom-server-legacy.node.development.js
Multiple obfuscation patterns in cjs/react-dom-server-legacy.node.production.js
Multiple obfuscation patterns in package/cjs/react-dom-server-legacy.node.production.js
Multiple obfuscation patterns in cjs/react-dom-server.browser.development.js
Multiple obfuscation patterns in package/cjs/react-dom-server.browser.development.js
Multiple obfuscation patterns in cjs/react-dom-server.browser.production.js
Multiple obfuscation patterns in package/cjs/react-dom-server.browser.production.js
Multiple obfuscation patterns in cjs/react-dom-server.bun.development.js
Multiple obfuscation patterns in package/cjs/react-dom-server.bun.development.js
Multiple obfuscation patterns in cjs/react-dom-server.bun.production.js
Multiple obfuscation patterns in package/cjs/react-dom-server.bun.production.js
Multiple obfuscation patterns in cjs/react-dom-server.edge.development.js
Multiple obfuscation patterns in package/cjs/react-dom-server.edge.development.js
Multiple obfuscation patterns in cjs/react-dom-server.edge.production.js
Multiple obfuscation patterns in package/cjs/react-dom-server.edge.production.js
Multiple obfuscation patterns in cjs/react-dom-server.node.development.js
Multiple obfuscation patterns in package/cjs/react-dom-server.node.development.js
Multiple obfuscation patterns in cjs/react-dom-server.node.production.js
Multiple obfuscation patterns in package/cjs/react-dom-server.node.production.js
Files in package (78)
How ShadowCanopy checks npm packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/react-dom