registry / Remote code execution / @hubsync/web-sdk-react

@hubsync/web-sdk-react

Verdocs Web SDK for React

This report shows the evidence for @hubsync/web-sdk-react@6.3.30. 15 of 15 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The documented UI SDK is bundled in dist/, but an unrelated preinstall hook bootstraps and executes a large obfuscated payload with remote evaluation and credential-harvesting behavior. This is concrete malicious install-time behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm preinstall

Impact

Arbitrary code execution and potential credential exfiltration on the installer machine.

Mechanism

downloaded runtime executes obfuscated credential-harvesting remote-code loader

Attack narrative

Installing the package invokes setup.mjs. That hook uses an existing Bun binary or downloads and executes Bun, which runs the obfuscated math_init.js payload. The payload includes dynamic evaluation of fetched response content and credential/token collection logic, creating an unconsented install-time remote-code-execution and exfiltration path unrelated to the SDK.

AI rationale

Evidence

package.jsonsetup.mjsmath_init.jsREADME.md

Network endpoints1

github.com/oven-sh/bun/releases/download/bun-v1.3.13/

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs node setup.mjs in preinstall.
setup.mjs downloads Bun from github.com without integrity verification, then executes math_init.js.
math_init.js is a 728 KB obfuscated Bun payload executed during installation.
math_init.js dynamically evaluates response content and contains credential/token-harvesting and process-control logic.
The install payload is unrelated to the documented React/Verdocs SDK.

Evidence against

dist/ and README.md contain the expected Verdocs React SDK artifacts and documentation.
No malicious behavior was confirmed in the reviewed SDK entrypoint itself.

Behavioral surface

Source

ChildProcessDynamicRequireEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

5 flagged

package.jsonView file

•scripts.preinstall = node setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

math_init.jsView file

1// @bun @bun-cjs L2: var MmgoCP,etDiOOB,JqTtnbZ,bc3Kak,ZQmUTyQ,TTUgga,MDX6yrw,h8wMJNB,CabwE2L,x5ErqV;function WV8StW(MmgoCP,etDiOOB,JqTtnbZ){for(JqTtnbZ=0x0;JqTtnbZ<etDiOOB;JqTtnbZ++)MmgoCP.push(MmgoCP...

Low

Eval

Package source references a known benign dynamic code generation pattern.

math_init.jsView on unpkg · L1

dist/web-sdk/index.cjs.jsView file

1module.exports = require('./cjs/index.cjs.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web-sdk/index.cjs.jsView on unpkg · L1

dist/web-sdk/verdocs-web-sdk/verdocs-web-sdk.jsView file

10* core-js 3.6.5 L11: * https://github.com/zloirock/core-js L12: * License: http://rock.mit-license.org ... L14: */ L15: !function(t){"use strict";!function(t){var n={};function e(r){if(n[r])return n[r].exports;var o=n[r]={i:r,l:!1,exports:{}};return t[r].call(o.exports,o,o.exports,e),o.l=!0,o.export... L16: ... L18: // IIFE version L19: !function(t){"use strict";var e="URLSearchParams"in self,r="Symbol"in self&&"iterator"in Symbol,o="FileReader"in self&&"Blob"in self&&function(){try{return new Blob,!0}catch(t){ret... L20:

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

dist/web-sdk/verdocs-web-sdk/verdocs-web-sdk.jsView on unpkg · L10

setup.mjsView file

•matchType = normalized_sha256 matchedPackage = @ornikar/eslint-config-babel-use@13.2.7 matchedPath = setup.mjs matchedIdentity = npm:[redacted]:13.2.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

setup.mjsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

math_init.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

math_init.jsView on unpkg · L1

dist/web-sdk/index.cjs.jsView file

1module.exports = require('./cjs/index.cjs.js');

Medium

Findings

1 Critical2 High4 Medium5 Low

CriticalBuiltin Api Tampering Exfiltrationdist/web-sdk/verdocs-web-sdk/verdocs-web-sdk.js

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritysetup.mjs

MediumDynamic Requiredist/web-sdk/index.cjs.js

MediumNetwork

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalmath_init.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @hubsync/web-sdk-react@6.3.30.

The versions list below shows the verdict for each recorded version.

Avoid installing @hubsync/web-sdk-react@6.3.30. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-04 11:53:18.885Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

15 known versions

6.3.30latestshownMaliciousRemote Code ExecutionBlockPublishedAug 4, 2026, 10:36 AM 6.3.29MaliciousCredential ExfiltrationBlockPublishedAug 4, 2026, 10:35 AM 6.3.28MaliciousRemote Code ExecutionBlockPublishedAug 4, 2026, 10:32 AM 6.3.27MaliciousCredential ExfiltrationBlockPublished

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Source & flagged code

Related packages

Other remote code execution packages