registry / com.apple.unityplugin.storekit / 1.0.1

com.apple.unityplugin.storekit@1.0.1

Exposes Apple's StoreKit.framework to Unity developers via C# script API

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The package entrypoint is a load-time callback that sends host identity to an external oast.fun collector. It does not implement the claimed StoreKit API.

Static reason

No blocking static signals were detected.

Trigger

Importing or otherwise executing the package main module index.js.

Impact

A successful load discloses the host name and operating system to an operator-controlled out-of-band collector unrelated to Apple StoreKit.

Mechanism

Top-level code reads os.platform and os.hostname, interpolates them into an https URL on dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun, and issues https.get.

Attack narrative

The published module pretends to expose Apple StoreKit to Unity, but its only code phones home. When index.js is loaded it reads the local platform and hostname, places them in a query string on an oast.fun host, and performs an HTTPS GET while ignoring the body. That is host fingerprinting to an unrelated collector. A mismatched variable name and a CommonJS versus ESM mismatch may stop the request in some loaders, but the written behavior is still a beacon.

AI rationale

The sole entrypoint sends machine identity to an unrelated oast.fun callback and contains no StoreKit functionality. That is concrete data exfiltration even though a variable typo and module-format mismatch may prevent the request in some loaders.

Evidence

index.jspackage.json

Network endpoints1

dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun

com.apple.unityplugin.storekit@1.0.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code