[Bug]: pretty-format npm aliases `react-is-18` and `react-is-19` collide with newly published npm packages

[avfarooq]

Version

30.4.1

Steps to reproduce

1. Install pretty-format@30.4.1.

2. Open packages/pretty-format/package.json and observe the following npm aliases:

"react-is-18": "npm:react-is@^18.3.1",
"react-is-19": "npm:react-is@^19.2.5"

3. Verify that react-is-18 and react-is-19 have been published as npm packages and currently contain no meaningful implementation.

4. Scan a project containing pretty-format with SCA tooling.

5. Observe that the aliases may be identified as the published packages instead of aliases to react-is, resulting in false-positive malware findings and potential supply chain concerns.

Reference:
https://github.com/jestjs/jest/blob/main/packages/pretty-format/package.json#L26-L27

Expected behavior

Dependency aliases should not collide with existing npm package names. SCA tooling should identify these as aliases to react-is, not separate packages.

Actual behavior

pretty-format defines the following aliases:

"react-is-18": "npm:react-is@^18.3.1",
"react-is-19": "npm:react-is@^19.2.5"

react-is-18 and react-is-19 have recently been published as npm packages. Because the alias names collide with existing package names, SCA tooling may identify them as the published packages instead of aliases to react-is. In our environment, these newly published packages are flagged as malicious, resulting in false-positive malware findings and potential supply chain concerns.

Additional context

This issue surfaced after react-is-18 and react-is-19 were recently published to npm. Prior to their publication, there was no package name collision. Since then, SCA tooling has begun treating the alias names as the published packages, leading to supply chain alerts.

• https://www.npmjs.com/package/react-is-18
• https://www.npmjs.com/package/react-is-19

Since these package names match the npm aliases used by pretty-format, SCA tooling has begun treating the aliases as the published packages, resulting in supply chain alerts. Renaming the aliases to names that cannot collide with publishable npm package names may help avoid this class of issue.

Environment

Not applicable.

This issue is in the published `pretty-format` package metadata (`package.json`) and is independent of the operating system, Node.js version, or runtime environment.

[Xiantongc612]

I've run into the same issue. It looks like a dependency confusion attack at first glance.