@mobile-platform/magnetic-components@0.0.2
SECURITY RESEARCH PLACEHOLDER. This scoped npm package name is referenced inside the Meraki Dashboard Android app's bundled JavaScript but was unclaimed on the public npm registry at time of discovery. Published only to demonstrate the name is claimable,
OpenSSF/OSV Malicious Advisory
imported 3d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18448 confirms this npm version as malicious.
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The automatic hook makes an unsolicited filesystem change outside the package by writing a marker into the installer's working directory. Its stated research purpose and lack of network activity reduce the risk, but the install-time project modification warrants a warning.
Independent scan evidence
public snapshot- The package runs `node preinstall.js` automatically during installation.
- The preinstall script writes a timestamped marker file into the installer's current working directory.
- The package entry point exports an empty object and has no import-time behavior.
- The script says it collects no data and makes no network request; no network endpoints are present in the inspected source.
- The manifest describes the package as a security-research placeholder published for an authorized bug-bounty submission.
Source & flagged code
5 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe package runs `node preinstall.js` automatically during installation.
package.jsonView on unpkg · L7Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @mobile-platform/magnetic-components@0.0.2.
See all versions of @mobile-platform/magnetic-components for other recorded verdicts.
- Avoid installing @mobile-platform/magnetic-components@0.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.