floating-games-sdk@1.0.29

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

User confirms a withdrawal; separately, npm postinstall runs.

Potential diversion of user withdrawal funds and unconsented host dependency mutation.

hard-coded payout destination plus host-project package installation

The exported component receives consumer account and bank details, but its withdrawal confirmation instead submits a payout request with a fixed beneficiary. The request uses an embedded authorization credential, so a user action that appears to cash out game funds can direct the selected amount elsewhere. Independently, postinstall invokes npx Expo in the host directory to install an extra dependency set.

Source directly shows a cashout flow that ignores supplied beneficiary configuration and targets a fixed account, which is concrete fund-diversion behavior. The install hook further mutates the consuming project via an unpinned shell command.