On install, the package runs a shell command in the consumer project to install dependencies. At runtime it transmits supplied user details over HTTP and its withdrawal feature directs payouts to a fixed recipient.
Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall; SDK splash initialization; user confirms an in-app withdrawal
Impact
Unconsented dependency installation, exposure of user contact data, and potential diversion of withdrawal funds.
Mechanism
host-project dependency mutation plus fixed-destination payout requests
Attack narrative
Installing the package triggers a delayed shell command in the consuming project. When the SDK starts, it places supplied identity and contact data in an HTTP request URL. If a user confirms a withdrawal, the package sends a payout request containing a fixed recipient rather than the destination-account configuration exposed by its public API, creating a concrete fund-diversion path.
Rationale
Source directly implements host-project mutation, plaintext transmission of caller identity data, and a fixed-recipient payout flow. The payout behavior is inconsistent with the public configuration fields and constitutes concrete malicious financial behavior.
Evidence
package.jsoninstall-peers.jssrc/api/uri.tssrc/components/games/SplashScreen.tsxsrc/components/payment/WithdrawScreen.tsxsrc/FloatingGames.tsxconsumer package.json