@mobile-platform/magnetic-components@0.0.1
SECURITY RESEARCH PLACEHOLDER. This scoped npm package name is referenced inside the Meraki Dashboard Android app's bundled JavaScript but was unclaimed on the public npm registry at time of discovery. Published only to demonstrate the name is claimable,
OpenSSF/OSV Malicious Advisory
imported 3d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18448 confirms this npm version as malicious.
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
The install hook's stated proof-of-concept behavior matches its implementation: it writes a local marker and identifies no data collection or network activity. The import entry point is empty, so the reviewed source does not show malicious behavior.
Independent scan evidence
public snapshot- The manifest describes the package as a security research placeholder and says it makes no network requests.
- The preinstall hook writes a timestamped marker file in the installer's current directory; its source says no data is collected or transmitted.
- The package entry point exports an empty object.
- The preinstall hook runs automatically and creates DEPENDENCY_CONFUSION_POC_MARKER.txt in the project directory.
Source & flagged code
8 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe manifest describes the package as a security research placeholder and says it makes no network requests.
package.jsonView on unpkg · L7Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @mobile-platform/magnetic-components@0.0.1.
See all versions of @mobile-platform/magnetic-components for other recorded verdicts.
- Avoid installing @mobile-platform/magnetic-components@0.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.