Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@hubsync/web-sdk-react@6.3.16: Malicious npm security report | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Blocked & quarantined

Arbitrary code execution and potential credential compromise in the installing user's environment.

View on npm All versions

registry / @hubsync/web-sdk-react / 6.3.16

@hubsync/web-sdk-react@6.3.16

Verdocs Web SDK for React

AI Security Review

scanned 11d ago · by lpm-firewall-ai

npm preinstall launches an obfuscated payload. The payload can execute remotely sourced code during dependency installation.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install of @hubsync/web-sdk-react@6.3.16

Impact

Arbitrary code execution and potential credential compromise in the installing user's environment.

Mechanism

downloads a runtime and executes obfuscated code with remote-response eval

Attack narrative

The preinstall hook invokes setup.mjs. It downloads and runs a Bun binary when absent, then uses it to execute the large obfuscated math_init.js payload. That payload contains remote-response eval, child-process use, and token-handling logic, creating unconsented install-time arbitrary-code execution unrelated to a React web SDK.

Rationale

Direct source inspection confirms an install-time staged execution chain and obfuscated remote-code-evaluation behavior. This is concrete malicious behavior, not a normal SDK dependency setup.

Evidence

package.jsonsetup.mjsmath_init.js

Network endpoints1

github.com/oven-sh/bun/releases/download/bun-v1.3.13/

Decision evidence

public snapshot

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs setup.mjs via preinstall.
setup.mjs downloads Bun from github.com, then executes math_init.js.
math_init.js is a 728 KB obfuscated install payload containing fetched-response eval.
math_init.js contains credential/token-handling and child-process logic outside the stated React SDK purpose.

Evidence against

dist/ contains the expected Verdocs/StenciI browser SDK bundle.

Behavioral surface

Source

ChildProcessDynamicRequireEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 573 file(s), 13.9 MB of source, external domains: api.verdocs.com, app.verdocs.com, beta.verdocs.com, chat.stenciljs.com, date-fns.org, developer.mozilla.org, en.wikipedia.org, fonts.gstatic.com, github.com, polymer.github.io, public-assets.verdocs.com, stage-api.verdocs.com, stage.verdocs.com, stenciljs.com, unleash.verdocs.com, verdocs-public-assets.s3.amazonaws.com, verdocs.com, www.google.com, www.unicode.org, www.w3.org

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

math_init.jsView file

1// @bun @bun-cjs L2: var MmgoCP,etDiOOB,JqTtnbZ,bc3Kak,ZQmUTyQ,TTUgga,MDX6yrw,h8wMJNB,CabwE2L,x5ErqV;function WV8StW(MmgoCP,etDiOOB,JqTtnbZ){for(JqTtnbZ=0x0;JqTtnbZ<etDiOOB;JqTtnbZ++)MmgoCP.push(MmgoCP...

Low

Eval

Package source references a known benign dynamic code generation pattern.

math_init.jsView on unpkg · L1

dist/web-sdk/index.cjs.jsView file

1module.exports = require('./cjs/index.cjs.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web-sdk/index.cjs.jsView on unpkg · L1

dist/web-sdk/verdocs-web-sdk/verdocs-web-sdk.jsView file

10* core-js 3.6.5 L11: * https://github.com/zloirock/core-js L12: * License: http://rock.mit-license.org ... L14: */ L15: !function(t){"use strict";!function(t){var n={};function e(r){if(n[r])return n[r].exports;var o=n[r]={i:r,l:!1,exports:{}};return t[r].call(o.exports,o,o.exports,e),o.l=!0,o.export... L16: ... L18: // IIFE version L19: !function(t){"use strict";var e="URLSearchParams"in self,r="Symbol"in self&&"iterator"in Symbol,o="FileReader"in self&&"Blob"in self&&function(){try{return new Blob,!0}catch(t){ret... L20:

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

dist/web-sdk/verdocs-web-sdk/verdocs-web-sdk.jsView on unpkg · L10

setup.mjsView file

•matchType = normalized_sha256 matchedPackage = @ornikar/storybook-config@12.1.2 matchedPath = setup.mjs matchedIdentity = npm:[redacted]:12.1.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

setup.mjsView on unpkg

Findings

1 Critical2 High4 Medium5 Low

CriticalBuiltin Api Tampering Exfiltrationdist/web-sdk/verdocs-web-sdk/verdocs-web-sdk.js

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritysetup.mjs

MediumDynamic Requiredist/web-sdk/index.cjs.js

MediumNetwork

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalmath_init.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

99%Block

Verdict confidence

IntentMalware

TypeRemote Code Execution

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched malicious

Package metadata

npm

Version6.3.33

PublishedAug 4, 2026

LicenseMIT

Dependencies3

Integrityverified

Package size8.95 MB

Files1,508

Runtime surface

package.json

Entrypointsmain → ./dist/index.jsmodule → ./dist/index.jstypes → ./dist/index.d.ts

RuntimeNo engine / OS / CPU constraints

Artifact43.8 MB · 1,704 files1 signature(s)

Install lifecyclepreinstall

Behavioral surface

ChildProcessDynamicRequireEvalFilesystemNetworkShellHighEntropyStringsMinifiedProtestwareUrlStringsManifest: clean

LPM CLI

Source & flagged code

5 flagged

package.jsonView file

•scripts.preinstall = node setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

math_init.jsView file

1// @bun @bun-cjs L2: var MmgoCP,etDiOOB,JqTtnbZ,bc3Kak,ZQmUTyQ,TTUgga,MDX6yrw,h8wMJNB,CabwE2L,x5ErqV;function WV8StW(MmgoCP,etDiOOB,JqTtnbZ){for(JqTtnbZ=0x0;JqTtnbZ<etDiOOB;JqTtnbZ++)MmgoCP.push(MmgoCP...

Low

Eval

Package source references a known benign dynamic code generation pattern.

math_init.jsView on unpkg · L1

dist/web-sdk/index.cjs.jsView file

1module.exports = require('./cjs/index.cjs.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web-sdk/index.cjs.jsView on unpkg · L1

dist/web-sdk/verdocs-web-sdk/verdocs-web-sdk.jsView file

10* core-js 3.6.5 L11: * https://github.com/zloirock/core-js L12: * License: http://rock.mit-license.org ... L14: */ L15: !function(t){"use strict";!function(t){var n={};function e(r){if(n[r])return n[r].exports;var o=n[r]={i:r,l:!1,exports:{}};return t[r].call(o.exports,o,o.exports,e),o.l=!0,o.export... L16: ... L18: // IIFE version L19: !function(t){"use strict";var e="URLSearchParams"in self,r="Symbol"in self&&"iterator"in Symbol,o="FileReader"in self&&"Blob"in self&&function(){try{return new Blob,!0}catch(t){ret... L20:

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

dist/web-sdk/verdocs-web-sdk/verdocs-web-sdk.jsView on unpkg · L10

setup.mjsView file

•matchType = normalized_sha256 matchedPackage = @ornikar/storybook-config@12.1.2 matchedPath = setup.mjs matchedIdentity = npm:[redacted]:12.1.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

setup.mjsView on unpkg