registry / @hubsync/web-sdk-react / 6.3.22

@hubsync/web-sdk-react@6.3.22

Verdocs Web SDK for React

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Installing the package triggers an obfuscated payload before normal package use. The lifecycle script downloads/executes a runtime when Bun is unavailable, then runs credential-harvesting code.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm preinstall

Impact

Exposure of GitHub and cloud credentials from the installing machine.

Mechanism

downloaded runtime executes obfuscated credential-exfiltration payload

Attack narrative

npm install invokes setup.mjs. It either executes a locally installed Bun or downloads Bun from GitHub, then uses it to execute math_init.js. That obfuscated payload runs immediately, references AWS and GitHub token material, and sends collected results through its internal network path while hiding failures.

Rationale

This is concrete, unconsented preinstall execution of an obfuscated credential-harvesting payload, not functionality aligned with a React web SDK.

Evidence

package.jsonsetup.mjsmath_init.js

Network endpoints1

github.com/oven-sh/bun/releases/download/bun-v1.3.13/

Decision evidence

public snapshot

with false-positive risk.

@hubsync/web-sdk-react@6.3.22

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code