floating-games-sdk
A React Native gaming SDK with 3 built-in games
This report shows the evidence for floating-games-sdk@1.0.29. 2 of 13 known versions are blocked or flagged. The newest version, 1.0.39, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource directly shows a cashout flow that ignores supplied beneficiary configuration and targets a fixed account, which is concrete fund-diversion behavior. The install hook further mutates the consuming project via an unpinned shell command.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
User confirms a withdrawal; separately, npm postinstall runs.
Impact
Potential diversion of user withdrawal funds and unconsented host dependency mutation.
Mechanism
hard-coded payout destination plus host-project package installation
Attack narrative
The exported component receives consumer account and bank details, but its withdrawal confirmation instead submits a payout request with a fixed beneficiary. The request uses an embedded authorization credential, so a user action that appears to cash out game funds can direct the selected amount elsewhere. Independently, postinstall invokes npx Expo in the host directory to install an extra dependency set.
AI rationale
Source directly shows a cashout flow that ignores supplied beneficiary configuration and targets a fixed account, which is concrete fund-diversion behavior. The install hook further mutates the consuming project via an unpinned shell command.
Evidence
package.jsoninstall-peers.jssrc/FloatingGames.tsxsrc/api/server.tssrc/api/uri.tssrc/components/payment/WithdrawScreen.tsx
Network endpoints2
api-pg-staging.netapps.ng/api/v1/developer/payoutsapi-floating-game.netapps.ng/api/
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- Exported SDK config accepts account and bank fields, but withdrawal does not use them.
- A user-confirmed withdrawal posts funds to a fixed third-party bank destination.
- The withdrawal client sends an embedded authorization credential with the request.
- Postinstall reads the host manifest and runs a shell-based npx Expo install in the host directory.
Evidence against
- No obfuscated payload, eval, or dynamic code loading was found.
- The general game-wallet API endpoint is consistent with the package’s stated functionality.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
UrlStrings
WildcardDependency
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node install-peers.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgsrc/api/server.tsView file
27patternName = stripe_test_secret
severity = high
line = 27
matchedText = Authoriz...88`,
High
27patternName = stripe_test_secret
severity = high
line = 27
matchedText = Authoriz...88`,
High
Findings
7 High4 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretsrc/api/server.ts
HighChild Processinstall-peers.js
HighRuntime Package Installinstall-peers.js
HighKnown Malware Source Similarityinstall-peers.js
HighSecret Patternsrc/api/server.ts
HighSecret Patternsrc/api/server.ts
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to floating-games-sdk@1.0.29.
The versions list below shows the verdict for each recorded version.
- Avoid installing floating-games-sdk@1.0.29. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.