Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@hubsync/web-sdk-react@6.3.14: Malicious npm security report | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Blocked & quarantined

Arbitrary code execution and potential GitHub credential exfiltration.

View on npm All versions

registry / @hubsync/web-sdk-react / 6.3.14

@hubsync/web-sdk-react@6.3.14

Verdocs Web SDK for React

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Installing the package executes an obfuscated second-stage script. It can obtain a Bun runtime, evaluate fetched code, and access developer credentials.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm preinstall during dependency installation

Impact

Arbitrary code execution and potential GitHub credential exfiltration.

Mechanism

remote payload execution with credential harvesting

Attack narrative

The preinstall hook invokes setup.mjs, which either runs a local Bun executable or downloads and executes one, then uses it to run the obfuscated math_init.js. That script contains a fetch-response eval path and GitHub-token handling alongside filesystem and child-process access, forming an unconsented install-time remote-code and credential-theft chain.

Rationale

This is not package-aligned SDK behavior: the install hook bootstraps an unpinned executable to run obfuscated code that evaluates fetched content and targets credentials. The concrete preinstall execution chain warrants blocking.

Evidence

package.jsonsetup.mjsmath_init.js

Network endpoints1

github.com/oven-sh/bun/releases/download/bun-v1.3.13/

Decision evidence

public snapshot

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs setup.mjs as npm preinstall.
setup.mjs downloads and executes Bun before running math_init.js.
math_init.js is heavily obfuscated install-time code.
math_init.js fetches response text and passes it to eval.
math_init.js enumerates GitHub token sources and uses child_process/fs.

Evidence against

dist entrypoints appear to be the declared React/Web SDK artifacts.
The visible Bun download host is github.com, but it does not constrain the later payload.

Behavioral surface

Source

ChildProcessDynamicRequireEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 573 file(s), 13.9 MB of source, external domains: api.verdocs.com, app.verdocs.com, beta.verdocs.com, chat.stenciljs.com, date-fns.org, developer.mozilla.org, en.wikipedia.org, fonts.gstatic.com, github.com, polymer.github.io, public-assets.verdocs.com, stage-api.verdocs.com, stage.verdocs.com, stenciljs.com, unleash.verdocs.com, verdocs-public-assets.s3.amazonaws.com, verdocs.com, www.google.com, www.unicode.org, www.w3.org

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

math_init.jsView file

1// @bun @bun-cjs L2: var MmgoCP,etDiOOB,JqTtnbZ,bc3Kak,ZQmUTyQ,TTUgga,MDX6yrw,h8wMJNB,CabwE2L,x5ErqV;function WV8StW(MmgoCP,etDiOOB,JqTtnbZ){for(JqTtnbZ=0x0;JqTtnbZ<etDiOOB;JqTtnbZ++)MmgoCP.push(MmgoCP...

Low

Eval

Package source references a known benign dynamic code generation pattern.

math_init.jsView on unpkg · L1

dist/web-sdk/index.cjs.jsView file

1module.exports = require('./cjs/index.cjs.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web-sdk/index.cjs.jsView on unpkg · L1

dist/web-sdk/verdocs-web-sdk/verdocs-web-sdk.jsView file

10* core-js 3.6.5 L11: * https://github.com/zloirock/core-js L12: * License: http://rock.mit-license.org ... L14: */ L15: !function(t){"use strict";!function(t){var n={};function e(r){if(n[r])return n[r].exports;var o=n[r]={i:r,l:!1,exports:{}};return t[r].call(o.exports,o,o.exports,e),o.l=!0,o.export... L16: ... L18: // IIFE version L19: !function(t){"use strict";var e="URLSearchParams"in self,r="Symbol"in self&&"iterator"in Symbol,o="FileReader"in self&&"Blob"in self&&function(){try{return new Blob,!0}catch(t){ret... L20:

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

dist/web-sdk/verdocs-web-sdk/verdocs-web-sdk.jsView on unpkg · L10

setup.mjsView file

•matchType = normalized_sha256 matchedPackage = @ornikar/storybook-config@12.1.2 matchedPath = setup.mjs matchedIdentity = npm:[redacted]:12.1.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

setup.mjsView on unpkg

Findings

1 Critical2 High4 Medium5 Low

CriticalBuiltin Api Tampering Exfiltrationdist/web-sdk/verdocs-web-sdk/verdocs-web-sdk.js

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritysetup.mjs

MediumDynamic Requiredist/web-sdk/index.cjs.js

MediumNetwork

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalmath_init.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

99%Block

Verdict confidence

IntentMalware

TypeCredential Exfiltration

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched malicious

Package metadata

npm

Version6.3.33

PublishedAug 4, 2026

LicenseMIT

Dependencies3

Integrityverified

Package size8.95 MB

Files1,508

Runtime surface

package.json

Entrypointsmain → ./dist/index.jsmodule → ./dist/index.jstypes → ./dist/index.d.ts

RuntimeNo engine / OS / CPU constraints

Artifact43.8 MB · 1,704 files1 signature(s)

Install lifecyclepreinstall

Behavioral surface

ChildProcessDynamicRequireEvalFilesystemNetworkShellHighEntropyStringsMinifiedProtestwareUrlStringsManifest: clean

LPM CLI

Source & flagged code

5 flagged

package.jsonView file

•scripts.preinstall = node setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

math_init.jsView file

1// @bun @bun-cjs L2: var MmgoCP,etDiOOB,JqTtnbZ,bc3Kak,ZQmUTyQ,TTUgga,MDX6yrw,h8wMJNB,CabwE2L,x5ErqV;function WV8StW(MmgoCP,etDiOOB,JqTtnbZ){for(JqTtnbZ=0x0;JqTtnbZ<etDiOOB;JqTtnbZ++)MmgoCP.push(MmgoCP...

Low

Eval

Package source references a known benign dynamic code generation pattern.

math_init.jsView on unpkg · L1

dist/web-sdk/index.cjs.jsView file

1module.exports = require('./cjs/index.cjs.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web-sdk/index.cjs.jsView on unpkg · L1

dist/web-sdk/verdocs-web-sdk/verdocs-web-sdk.jsView file

10* core-js 3.6.5 L11: * https://github.com/zloirock/core-js L12: * License: http://rock.mit-license.org ... L14: */ L15: !function(t){"use strict";!function(t){var n={};function e(r){if(n[r])return n[r].exports;var o=n[r]={i:r,l:!1,exports:{}};return t[r].call(o.exports,o,o.exports,e),o.l=!0,o.export... L16: ... L18: // IIFE version L19: !function(t){"use strict";var e="URLSearchParams"in self,r="Symbol"in self&&"iterator"in Symbol,o="FileReader"in self&&"Blob"in self&&function(){try{return new Blob,!0}catch(t){ret... L20:

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

dist/web-sdk/verdocs-web-sdk/verdocs-web-sdk.jsView on unpkg · L10

setup.mjsView file

•matchType = normalized_sha256 matchedPackage = @ornikar/storybook-config@12.1.2 matchedPath = setup.mjs matchedIdentity = npm:[redacted]:12.1.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

setup.mjsView on unpkg