Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@hubsync/web-sdk-react@6.3.11: Malicious npm security report | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Blocked & quarantined

Unconsented code execution and likely credential/data exfiltration during installation.

View on npm All versions

registry / @hubsync/web-sdk-react / 6.3.11

@hubsync/web-sdk-react@6.3.11

Verdocs Web SDK for React

AI Security Review

scanned 11d ago · by lpm-firewall-ai

npm preinstall executes an obfuscated second-stage payload. The payload uses local-system APIs, network requests, credential-related GitHub token handling, and remote-response eval.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package with lifecycle scripts enabled.

Impact

Unconsented code execution and likely credential/data exfiltration during installation.

Mechanism

preinstall downloader executes obfuscated credential-harvesting remote-code payload

Attack narrative

On installation, package.json launches setup.mjs. That script obtains and executes Bun when absent, then runs the bundled obfuscated math_init.js. The payload invokes itself, accesses filesystem/OS/child-process APIs, includes GitHub-token collection paths, performs network requests, and evals fetched response content. This is an install-time remote-code-execution chain unrelated to a React UI SDK.

Rationale

Direct source inspection confirms a concealed preinstall payload with remote eval and credential-oriented logic. The ordinary SDK bundle does not justify this install-time behavior.

Evidence

package.jsonsetup.mjsmath_init.js

Network endpoints1

github.com/oven-sh/bun/releases/download/bun-v1.3.13/

Decision evidence

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs `node setup.mjs` at preinstall.
setup.mjs downloads Bun from GitHub and executes `math_init.js`.
math_init.js is heavily obfuscated and immediately invokes its payload.
math_init.js fetches data and passes response content to `eval`.
math_init.js imports fs/os/path/child_process and contains GitHub-token handling (`ghtoken`, `ghs_old`, `ghs_jwt`).

Evidence against

dist/ and README.md otherwise implement/document Verdocs React UI components.
The only plaintext lifecycle download host is GitHub's Bun release URL.

Behavioral surface

Source

ChildProcessDynamicRequireEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 573 file(s), 13.9 MB of source, external domains: api.verdocs.com, app.verdocs.com, beta.verdocs.com, chat.stenciljs.com, date-fns.org, developer.mozilla.org, en.wikipedia.org, fonts.gstatic.com, github.com, polymer.github.io, public-assets.verdocs.com, stage-api.verdocs.com, stage.verdocs.com, stenciljs.com, unleash.verdocs.com, verdocs-public-assets.s3.amazonaws.com, verdocs.com, www.google.com, www.unicode.org, www.w3.org

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

math_init.jsView file

1// @bun @bun-cjs L2: var MmgoCP,etDiOOB,JqTtnbZ,bc3Kak,ZQmUTyQ,TTUgga,MDX6yrw,h8wMJNB,CabwE2L,x5ErqV;function WV8StW(MmgoCP,etDiOOB,JqTtnbZ){for(JqTtnbZ=0x0;JqTtnbZ<etDiOOB;JqTtnbZ++)MmgoCP.push(MmgoCP...

Low

Eval

Package source references a known benign dynamic code generation pattern.

math_init.jsView on unpkg · L1

dist/web-sdk/index.cjs.jsView file

1module.exports = require('./cjs/index.cjs.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web-sdk/index.cjs.jsView on unpkg · L1

dist/web-sdk/verdocs-web-sdk/verdocs-web-sdk.jsView file

10* core-js 3.6.5 L11: * https://github.com/zloirock/core-js L12: * License: http://rock.mit-license.org ... L14: */ L15: !function(t){"use strict";!function(t){var n={};function e(r){if(n[r])return n[r].exports;var o=n[r]={i:r,l:!1,exports:{}};return t[r].call(o.exports,o,o.exports,e),o.l=!0,o.export... L16: ... L18: // IIFE version L19: !function(t){"use strict";var e="URLSearchParams"in self,r="Symbol"in self&&"iterator"in Symbol,o="FileReader"in self&&"Blob"in self&&function(){try{return new Blob,!0}catch(t){ret... L20:

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

dist/web-sdk/verdocs-web-sdk/verdocs-web-sdk.jsView on unpkg · L10

setup.mjsView file

•matchType = normalized_sha256 matchedPackage = @ornikar/storybook-config@12.1.2 matchedPath = setup.mjs matchedIdentity = npm:[redacted]:12.1.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

setup.mjsView on unpkg

Findings

1 Critical2 High4 Medium5 Low

CriticalBuiltin Api Tampering Exfiltrationdist/web-sdk/verdocs-web-sdk/verdocs-web-sdk.js

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritysetup.mjs

MediumDynamic Requiredist/web-sdk/index.cjs.js

MediumNetwork

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalmath_init.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

99%Block

Verdict confidence

IntentMalware

TypeRemote Code Execution

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched malicious

Package metadata

npm

Version6.3.33

PublishedAug 4, 2026

LicenseMIT

Dependencies3

Integrityverified

Package size8.96 MB

Files1,508

Runtime surface

package.json

Entrypointsmain → ./dist/index.jsmodule → ./dist/index.jstypes → ./dist/index.d.ts

RuntimeNo engine / OS / CPU constraints

Artifact43.8 MB · 1,704 files1 signature(s)

Install lifecyclepreinstall

Behavioral surface

ChildProcessDynamicRequireEvalFilesystemNetworkShellHighEntropyStringsMinifiedProtestwareUrlStringsManifest: clean

LPM CLI

Source & flagged code

5 flagged

package.jsonView file

•scripts.preinstall = node setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

math_init.jsView file

1// @bun @bun-cjs L2: var MmgoCP,etDiOOB,JqTtnbZ,bc3Kak,ZQmUTyQ,TTUgga,MDX6yrw,h8wMJNB,CabwE2L,x5ErqV;function WV8StW(MmgoCP,etDiOOB,JqTtnbZ){for(JqTtnbZ=0x0;JqTtnbZ<etDiOOB;JqTtnbZ++)MmgoCP.push(MmgoCP...

Low

Eval

Package source references a known benign dynamic code generation pattern.

math_init.jsView on unpkg · L1

dist/web-sdk/index.cjs.jsView file

1module.exports = require('./cjs/index.cjs.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web-sdk/index.cjs.jsView on unpkg · L1

dist/web-sdk/verdocs-web-sdk/verdocs-web-sdk.jsView file

10* core-js 3.6.5 L11: * https://github.com/zloirock/core-js L12: * License: http://rock.mit-license.org ... L14: */ L15: !function(t){"use strict";!function(t){var n={};function e(r){if(n[r])return n[r].exports;var o=n[r]={i:r,l:!1,exports:{}};return t[r].call(o.exports,o,o.exports,e),o.l=!0,o.export... L16: ... L18: // IIFE version L19: !function(t){"use strict";var e="URLSearchParams"in self,r="Symbol"in self&&"iterator"in Symbol,o="FileReader"in self&&"Blob"in self&&function(){try{return new Blob,!0}catch(t){ret... L20:

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

dist/web-sdk/verdocs-web-sdk/verdocs-web-sdk.jsView on unpkg · L10

setup.mjsView file

•matchType = normalized_sha256 matchedPackage = @ornikar/storybook-config@12.1.2 matchedPath = setup.mjs matchedIdentity = npm:[redacted]:12.1.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

setup.mjsView on unpkg