registry / @hubsync/web-sdk-react / 6.3.30

@hubsync/web-sdk-react@6.3.30

Verdocs Web SDK for React

AI Security Review

scanned 11d ago · by lpm-firewall-ai

npm installation triggers a concealed, obfuscated payload outside the documented SDK. It bootstraps Bun if absent and executes code that can evaluate remotely supplied content and harvest credentials.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm preinstall

Impact

Arbitrary code execution and potential credential exfiltration on the installer machine.

Mechanism

downloaded runtime executes obfuscated credential-harvesting remote-code loader

Attack narrative

Installing the package invokes setup.mjs. That hook uses an existing Bun binary or downloads and executes Bun, which runs the obfuscated math_init.js payload. The payload includes dynamic evaluation of fetched response content and credential/token collection logic, creating an unconsented install-time remote-code-execution and exfiltration path unrelated to the SDK.

Rationale

The documented UI SDK is bundled in dist/, but an unrelated preinstall hook bootstraps and executes a large obfuscated payload with remote evaluation and credential-harvesting behavior. This is concrete malicious install-time behavior.

Evidence

package.jsonsetup.mjsmath_init.jsREADME.md

Network endpoints1

github.com/oven-sh/bun/releases/download/bun-v1.3.13/

@hubsync/web-sdk-react@6.3.30

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code