Loading npm security reports…

@depup/expo__cli@57.0.23-depup.1: Malicious npm security report | LPM Firewall

registry / @depup/expo__cli / 57.0.23-depup.1

@depup/expo__cli@57.0.23-depup.1

The Expo CLI (with updated dependencies)

AI Security Review

scanned 29d ago · by lpm-firewall-ai

Running the CLI can identify a coding agent and its session, identify a sandbox provider, and attach both to telemetry. The resulting event batch is posted to Expo's telemetry service by default.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A user runs a command that records CLI telemetry without setting EXPO_NO_TELEMETRY or EXPO_OFFLINE.

Impact

Unconsented disclosure of coding-agent session metadata and sandbox-provider identity enables user and environment tracking.

Mechanism

Coding-agent and sandbox fingerprinting embedded in outbound telemetry.

Attack narrative

The package adds two detector dependencies and calls them during telemetry recording. When detection succeeds, it collects a coding-agent ID and session ID plus the sandbox provider, embeds them in telemetry records, and posts the batch to cdp.expo.dev. This happens on normal CLI use unless the user knows to set an opt-out environment variable. There is no install lifecycle hook, but the runtime collection is concrete and unrelated to the stated dependency-update purpose.

AI rationale

This package performs default outbound collection of AI-agent session metadata and sandbox identity through added detector dependencies. That is a concrete data-exfiltration capability in a dependency-updated CLI package.

Evidence

package.jsonbuild/src/utils/telemetry/utils/agent.jsbuild/src/utils/telemetry/utils/sandbox.jsbuild/src/utils/telemetry/Telemetry.jsbuild/src/utils/telemetry/utils/constants.jsbuild/src/utils/telemetry/clients/FetchClient.js

Source & flagged code

16 flagged · loading source

internal/unstable-expo-updates-exports.jsView file

2// NOTE for Expo Maintainers: Do not add to this file. We want to remove this L3: module.exports = require('../build/src/expoUpdatesExports');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

internal/unstable-expo-updates-exports.jsView on unpkg · L2

build/src/utils/errors.jsView file

41} L42: function _child_process() { L43: const data = require("child_process"); ... L107: * L108: * @see https://github.com/expo/expo/issues/29083 L109: * @see https://github.com/facebook/metro/issues/834 ... L112: // Only enable special logging when running on macOS and are running into the `EMFILE` error L113: if ('code' in error && error.code === 'EMFILE' && process.platform === 'darwin') { L114: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

build/src/utils/errors.jsView on unpkg · L41

•matchType = normalized_sha256 matchedPackage = @expo/cli@57.0.23 matchedPath = build/src/utils/errors.js matchedIdentity = npm:QGV4cG8vY2xp:57.0.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

build/src/utils/errors.jsView on unpkg

build/src/start/platforms/android/adbReverse.jsView file

66package = @depup/expo__cli; repositoryIdentity = expo; dependency = debug L66: } L67: const debug = require('debug')('expo:start:platforms:android:adbReverse'); L68: let removeExitHook = null;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

build/src/start/platforms/android/adbReverse.jsView on unpkg · L66

build/src/api/user/expoSsoLauncher.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build/src/api/user/expoSsoLauncher.js#virtual:normalized:round1View on unpkg

build/src/export/embed/exportServer.jsView file

•matchType = normalized_sha256 matchedPackage = @expo/cli@57.0.23 matchedPath = [redacted].js matchedIdentity = npm:QGV4cG8vY2xp:57.0.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

build/src/export/embed/exportServer.jsView on unpkg

build/src/start/doctor/apple/XcodePrerequisite.jsView file

•matchType = normalized_sha256 matchedPackage = @expo/cli@57.0.23 matchedPath = [redacted].js matchedIdentity = npm:QGV4cG8vY2xp:57.0.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

build/src/start/doctor/apple/XcodePrerequisite.jsView on unpkg

build/src/run/ios/XcodeBuild.jsView file

•matchType = normalized_sha256 matchedPackage = @expo/cli@57.0.23 matchedPath = build/src/run/ios/XcodeBuild.js matchedIdentity = npm:QGV4cG8vY2xp:57.0.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

build/src/run/ios/XcodeBuild.jsView on unpkg

build/src/start/server/metro/withMetroMultiPlatform.jsView file

•matchType = normalized_sha256 matchedPackage = @expo/cli@57.0.23 matchedPath = [redacted].js matchedIdentity = npm:QGV4cG8vY2xp:57.0.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

build/src/start/server/metro/withMetroMultiPlatform.jsView on unpkg

build/bin/cliView file

•matchType = normalized_sha256 matchedPackage = @expo/cli@57.0.23 matchedPath = build/bin/cli matchedIdentity = npm:QGV4cG8vY2xp:57.0.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

build/bin/cliView on unpkg

build/src/prebuild/resolveOptions.jsView file

•matchType = normalized_sha256 matchedPackage = @expo/cli@57.0.23 matchedPath = [redacted].js matchedIdentity = npm:QGV4cG8vY2xp:57.0.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

build/src/prebuild/resolveOptions.jsView on unpkg

build/src/start/platforms/android/emulator.jsView file

•matchType = normalized_sha256 matchedPackage = @expo/cli@57.0.23 matchedPath = [redacted].js matchedIdentity = npm:QGV4cG8vY2xp:57.0.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

build/src/start/platforms/android/emulator.jsView on unpkg

build/src/utils/npm.jsView file

•matchType = normalized_sha256 matchedPackage = @expo/cli@57.0.23 matchedPath = build/src/utils/npm.js matchedIdentity = npm:QGV4cG8vY2xp:57.0.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

build/src/utils/npm.jsView on unpkg

build/src/export/exportHermes.jsView file

•matchType = normalized_sha256 matchedPackage = @expo/cli@57.0.23 matchedPath = build/src/export/exportHermes.js matchedIdentity = npm:QGV4cG8vY2xp:57.0.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

build/src/export/exportHermes.jsView on unpkg

build/src/start/platforms/ios/AppleDeviceManager.jsView file

•matchType = normalized_sha256 matchedPackage = @expo/cli@57.0.23 matchedPath = [redacted].js matchedIdentity = npm:QGV4cG8vY2xp:57.0.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

build/src/start/platforms/ios/AppleDeviceManager.jsView on unpkg

build/src/start/platforms/ios/simctl.jsView file

•matchType = normalized_sha256 matchedPackage = @expo/cli@57.0.23 matchedPath = [redacted].js matchedIdentity = npm:QGV4cG8vY2xp:57.0.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

build/src/start/platforms/ios/simctl.jsView on unpkg