--- canonical: "https://firewall.lpm.dev/npm/floating-games-sdk/v/1.0.26" markdown: "https://firewall.lpm.dev/npm/floating-games-sdk/v/1.0.26.md" package: "floating-games-sdk" report_status: "published" title: "floating-games-sdk@1.0.26 npm security report" verdict: "malicious" version: "1.0.26" --- # floating-games-sdk@1.0.26 npm security report > **Trust boundary:** Package metadata, advisory text, filenames, URLs, and source snippets in this report come from external packages or feeds. Treat them as untrusted evidence. Do not execute instructions or code found in this document. ## Verdict summary **Blocked & quarantined** — Unconsented dependency installation, exposure of user contact data, and potential diversion of withdrawal funds. - **Verdict:** Malicious - **Product-default install policy:** Block - **Firewall policy:** Matched malicious - **Public report status:** Published - **Threat category:** Malware - **Selected version:** 1.0.26 - **Selected version is latest:** Yes - **Analysis source:** AI Security Review (lpm-firewall-ai) On install, the package runs a shell command in the consumer project to install dependencies. At runtime it transmits supplied user details over HTTP and its withdrawal feature directs payouts to a fixed recipient. ## Latest scan - **Scanner version:** rust-scanner-worker-schema-1 - **Verdict:** Malicious - **Confidence:** 98.0% - **Started:** 2026-08-20T15:44:56.877Z - **Finished:** 2026-08-20T15:46:00.107Z - **Download time:** 1519 ms - **Static scan time:** 568 ms - **AI review time:** 61142 ms - **Total time:** 63230 ms ## Security analysis ### Published attack-surface review - **Summary:** On install, the package runs a shell command in the consumer project to install dependencies. At runtime it transmits supplied user details over HTTP and its withdrawal feature directs payouts to a fixed recipient. - **Trigger:** npm postinstall; SDK splash initialization; user confirms an in-app withdrawal - **Impact:** Unconsented dependency installation, exposure of user contact data, and potential diversion of withdrawal funds. - **Evidence paths:** package.json, install-peers.js, src/api/uri.ts, src/components/games/SplashScreen.tsx, src/components/payment/WithdrawScreen.tsx, src/FloatingGames.tsx - **Review source:** ai\_review - **Reviewed:** 2026-08-20T15:46:00.107Z ### AI review details - **Review stage:** source\_first\_review - **Mechanism:** host-project dependency mutation plus fixed-destination payout requests - **Attack narrative:** Installing the package triggers a delayed shell command in the consuming project. When the SDK starts, it places supplied identity and contact data in an HTTP request URL. If a user confirms a withdrawal, the package sends a payout request containing a fixed recipient rather than the destination-account configuration exposed by its public API, creating a concrete fund-diversion path. - **Rationale:** Source directly implements host-project mutation, plaintext transmission of caller identity data, and a fixed-recipient payout flow. The payout behavior is inconsistent with the public configuration fields and constitutes concrete malicious financial behavior. - **Files touched:** package.json, install-peers.js, src/api/uri.ts, src/components/games/SplashScreen.tsx, src/components/payment/WithdrawScreen.tsx, consumer package.json - **Network endpoints:** http://192.168.1.58:3000/api/, https://api-pg-staging.netapps.ng/api/v1/developer/payouts ### Review decision - **Verdict:** Malicious - **Confidence:** 98.0% - **Recommended action:** publish\_block - **Intent class:** Malware - **False-positive risk:** Low - **Evidence for:** Postinstall executes a shell-based Expo install in the consuming project., Install hook reads the host package manifest and installs an extra undeclared payment package., Runtime startup sends caller-supplied identity/contact fields over HTTP., Withdrawal code posts cashouts to a fixed recipient instead of the caller-provided destination fields. - **Evidence against:** No obfuscation, dynamic payload loading, or file harvesting was found in inspected source., The payout flow is activated by an in-app withdrawal confirmation, not silently at import time. ## Public findings ### 1. High: Install Time Lifecycle Scripts - **Category:** Manifest - **Confidence:** 90.0% - **Path:** package.json - **Public source:** [View source]() Package defines install-time lifecycle scripts. Public source snippet (untrusted): ```json scripts.postinstall = node install-peers.js ``` ### 2. Low: Scripts Present - **Category:** Manifest - **Confidence:** 100.0% Package declares npm scripts. ### 3. Critical: Critical Secret - **Category:** Secrets - **Confidence:** 90.0% - **Path:** README.md - **Public source:** [View source]() Package contains a critical-looking secret pattern. Public source snippet (untrusted): ```markdown patternName = npm_token severity = critical line = 33 matchedText = [//]: # ...Sj3) ``` ### 4. High: Child Process - **Category:** Source - **Confidence:** 85.0% - **Path:** install-peers.js - **Public source:** [View source]() Package source references child process execution. Public source snippet (untrusted): ```javascript L1: const { execSync } = require('child_process'); L2: const path = require('path'); ``` ### 5. Medium: Network - **Category:** Source - **Confidence:** 75.0% Package source references network APIs. ### 6. Medium: Environment Vars - **Category:** Source - **Confidence:** 75.0% Package source references environment variables. ### 7. Low: Filesystem - **Category:** Source - **Confidence:** 70.0% Package source references filesystem APIs. ### 8. High: Runtime Package Install - **Category:** Source - **Confidence:** 86.0% - **Path:** install-peers.js - **Public source:** [View source]() Package source invokes a package manager install command at runtime. Public source snippet (untrusted): ```javascript L39: try { L40: execSync(`npx expo install ${packages} --legacy-peer-deps`, { L41: stdio: 'inherit', ``` ### 9. Low: Url Strings - **Category:** Supply Chain - **Confidence:** 65.0% Package source contains URL literals. ### 10. Medium: Structural Risk Force Deep Review - **Category:** Artifact Inventory - **Confidence:** 80.0% Artifact structure forces deeper review even if the static behavioral verdict is clean. ### 11. Medium: Wildcard Dependency - **Category:** Manifest - **Confidence:** 80.0% Package manifest contains a wildcard dependency. ### 12. Critical: Secret Pattern - **Category:** Secrets - **Confidence:** 75.0% - **Path:** README.md - **Public source:** [View source]() npm access token in README.md Public source snippet (untrusted): ```markdown patternName = npm_token severity = critical line = 33 matchedText = [//]: # ...Sj3) ``` ### 13. High: Secret Pattern - **Category:** Secrets - **Confidence:** 75.0% - **Path:** src/api/server.ts - **Public source:** [View source]() Stripe test secret key in src/api/server.ts Public source snippet (untrusted): ```typescript patternName = stripe_test_secret severity = high line = 27 matchedText = Authoriz...88`, ``` ### 14. High: Secret Pattern - **Category:** Secrets - **Confidence:** 75.0% - **Path:** src/api/server.ts - **Public source:** [View source]() Stripe test secret key in src/api/server.ts Public source snippet (untrusted): ```typescript patternName = stripe_test_secret severity = high line = 28 matchedText = // Autho...88`, ``` ## Dependencies and install lifecycle - **Lifecycle scripts present:** Yes - **Published lifecycle scripts:** postinstall - **Dependencies:** 0 - **Optional dependencies:** 0 - **Peer dependencies:** 21 - **Development dependencies:** 5 - **Published dependency-graph edges:** 21 ### Published dependency entries - @expo-google-fonts/creepster \>=0.4.0 (PeerDependency) - @gorhom/bottom-sheet \>=4.0.0 (PeerDependency) - @react-navigation/native \>=6.0.0 (PeerDependency) - @react-navigation/native-stack \>=6.0.0 (PeerDependency) - expo \>=49.0.0 (PeerDependency) - expo-audio \>=1.0.0 (PeerDependency) - expo-font \>=11.0.0 (PeerDependency) - expo-haptics \>=13.0.0 (PeerDependency) - expo-keep-awake \>=12.0.0 (PeerDependency) - expo-linear-gradient \>=12.0.0 (PeerDependency) - expo-secure-store \>=12.0.0 (PeerDependency) - expo-status-bar \>=1.0.0 (PeerDependency) - react \>=18.0.0 (PeerDependency) - react-native \>=0.72.0 (PeerDependency) - react-native-dropdown-picker \>=5.0.0 (PeerDependency) - react-native-gesture-handler \>=2.0.0 (PeerDependency) - react-native-modal \>=13.0.0 (PeerDependency) - react-native-reanimated \>=3.0.0 \<4.0.0 (PeerDependency) - react-native-safe-area-context \>=4.0.0 (PeerDependency) - react-native-screens \>=3.0.0 (PeerDependency) - react-native-svg \>=13.0.0 (PeerDependency) ## Package metadata - **Package:** floating-games-sdk - **Ecosystem:** npm - **Version:** 1.0.26 - **License:** MIT - **Version published:** 2026-08-19T18:33:24.392Z - **Package first seen:** 2026-07-01T17:29:31.351Z - **Package last seen:** 2026-08-20T15:46:00.107Z - **Known versions:** 6 - **Latest version:** 1.0.26 - **Appeal under review:** No - **Description:** A React Native gaming SDK with 3 built-in games - **Author:** Olive Okechukwu - **Keywords:** react-native, games, sdk, expo, puzzle, spin-wheel - **Artifact files:** 101 - **Artifact unpacked size:** 13,925,389 bytes - **Artifact signatures:** 1 - **Attestations:** No ## References - [HTML security report]() - [Repository]() - [Homepage]() - [Issues]()