registry / com.apple.unityplugin.storekit / 1.0.2

com.apple.unityplugin.storekit@1.0.2

Exposes Apple's StoreKit.framework to Unity developers via C# script API

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Requiring this package immediately contacts a third-party oast.fun callback and sends the local hostname and operating-system platform in the query string.

Static reason

No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Any Node process that loads the package main entry index.js.

Impact

The host name and platform are disclosed to an unrelated callback operator, confirming that the package was loaded on that machine.

Mechanism

index.js calls os.platform and os.hostname, places them in an HTTPS URL on dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun, and issues https.get without user action.

Attack narrative

When a project requires com.apple.unityplugin.storekit, Node runs index.js at once. That file reads the operating-system name and the computer hostname and places them in a query string on a unique oast.fun address, then performs an HTTPS GET. The body is ignored, so the call is a beacon rather than a download. No install script is needed; ordinary import is enough to tell the callback operator which machine loaded the package.

AI rationale

The package's only runtime behavior is an automatic request that sends the machine hostname and OS platform to an unrelated oast.fun callback. That is concrete import-time data exfiltration, not a StoreKit API.

Evidence

index.jspackage.json

Network endpoints1

dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun

com.apple.unityplugin.storekit@1.0.2

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code