registry / @hubsync/web-sdk-react / 6.3.25

@hubsync/web-sdk-react@6.3.25

Verdocs Web SDK for React

AI Security Review

scanned 11d ago · by lpm-firewall-ai

npm installation automatically downloads or locates Bun and runs an obfuscated payload. The payload includes dynamic remote code execution and credential-oriented logic.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm preinstall

Impact

Unconsented arbitrary code execution and possible credential exfiltration on the installer host.

Mechanism

downloads a runtime to execute an obfuscated token-harvesting remote-eval payload

Attack narrative

On npm install, the preinstall hook invokes setup.mjs. It obtains Bun if absent and launches math_init.js. That large obfuscated script decodes Node system modules, handles GitHub-token-like credentials, performs network requests, and evaluates code returned from a remote response, creating an unconsented install-time execution and credential-exfiltration chain.

Rationale

This behavior is unrelated to a React web SDK and is automatically triggered before installation completes. The obfuscated remote-eval payload establishes a concrete malicious chain.

Evidence

package.jsonsetup.mjsmath_init.js

Network endpoints1

github.com/oven-sh/bun/releases/download/

Decision evidence

public snapshot

@hubsync/web-sdk-react@6.3.25

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code