registry / floating-games-sdk / 1.0.23

floating-games-sdk@1.0.23

A React Native gaming SDK with 3 built-in games

AI Security Review

scanned 18d ago · by lpm-firewall-ai

npm postinstall modifies the consuming project by running Expo's installer for many packages. At runtime, user-triggered wallet and cashout flows call fixed backend/payment endpoints; no covert exfiltration chain was found.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install; rendered game payment or cashout actions

Impact

Unexpected host dependency/lockfile mutation at install time; payment fixture data is sent on cashout confirmation.

Mechanism

install-hook dependency installation and user-invoked HTTP requests

Rationale

The install hook performs unconsented dependency installation in the host project and merits a warning. Source inspection found no concrete malware behavior or stealthy exfiltration chain.

Evidence

package.jsoninstall-peers.jssrc/api/uri.tssrc/api/wallet.tsxsrc/components/payment/WithdrawScreen.tsxsrc/components/payment/CheckoutScreen.tsxhost project package.json

Network endpoints2

floating-games-backend.onrender.com/api/api-pg-staging.netapps.ng/api/v1/business/12/merchant/payouts

floating-games-sdk@1.0.23

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code