@mobile-platform/magnetic-components
SECURITY RESEARCH PLACEHOLDER. This scoped npm package name is referenced inside the Meraki Dashboard Android app's bundled JavaScript but was unclaimed on the public npm registry at time of discovery. Published only to demonstrate the name is claimable,
This report shows the evidence for @mobile-platform/magnetic-components@0.0.3. 3 of 4 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe preinstall hook automatically contacts a hard-coded out-of-band DNS endpoint, which reports installation activity to an external observer. The source indicates no machine data is intentionally included, so this is install-hook abuse rather than credential or data exfiltration.
Decision evidence
public snapshot- The package runs preinstall.js automatically through its preinstall lifecycle script.
- preinstall.js performs a DNS lookup to a fixed out-of-band oast.me hostname, confirming an install to an external observer.
- The package entry point only exports an empty object.
- The preinstall comments claim that no machine data is collected or sent; the lookup uses a static hostname.
Source & flagged code
5 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe package runs preinstall.js automatically through its preinstall lifecycle script.
package.jsonView on unpkg · L7Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @mobile-platform/magnetic-components@0.0.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing @mobile-platform/magnetic-components@0.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.