floating-games-sdk@1.0.37
A React Native gaming SDK with 3 built-in games
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe automatic postinstall dependency installation mutates the consumer project and introduces package-fetching behavior, a real install-time risk. The inspected source does not show a concrete malicious payload or the self-dependency chain required for blocking.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing floating-games-sdk through npm, which runs its postinstall hook.
Impact
It can add or alter dependencies in the consumer project during package installation; no further malicious payload or secret collection was identified.
Mechanism
The hook schedules npx expo install for a fixed dependency list with the consumer project as its working directory.
AI rationale
The automatic postinstall dependency installation mutates the consumer project and introduces package-fetching behavior, a real install-time risk. The inspected source does not show a concrete malicious payload or the self-dependency chain required for blocking.
Evidence
package.jsoninstall-peers.js
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs install-peers.js automatically after installation.
- The hook reads the consumer project's package.json and targets its working directory.
- The hook runs npx expo install with a fixed list of packages in the consumer project.
- The imported SDK has a package-aligned API endpoint and sends player balance requests when its wallet function is called.
Evidence against
- The install hook skips when the host package is floating-games-sdk itself.
- The inspected wallet request is activated by calling the wallet function; no credential forwarding was identified.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node install-peers.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkginstall-peers.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = floating-games-sdk@1.0.32
matchedIdentity = npm:ZmxvYXRpbmctZ2FtZXMtc2Rr:1.0.32
similarity = 0.800
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
install-peers.jsView on unpkg1const { execSync } = require('child_process');
L2: const path = require('path');
High
Child Process
Package source references child process execution.
install-peers.jsFindings
1 Critical5 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltainstall-peers.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processinstall-peers.js
HighShellinstall-peers.js
HighRuntime Package Installinstall-peers.js
HighKnown Malware Source Similarityinstall-peers.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to floating-games-sdk@1.0.37.
See all versions of floating-games-sdk for other recorded verdicts.
- Review the evidence and your use of floating-games-sdk@1.0.37 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.