floating-games-sdk@1.0.38
A React Native gaming SDK with 3 built-in games
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe postinstall hook automatically modifies the host project's dependencies, creating a concrete install-time capability risk. The fixed dependency list aligns with the SDK's React Native and Expo purpose, so the source supports a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Installing the package with its postinstall lifecycle enabled.
Impact
Consumer dependencies may be added or changed without a separate user-invoked setup command; no separate attack behavior was established.
Mechanism
The hook schedules a shell command that runs npx expo install from the host project's directory.
AI rationale
The postinstall hook automatically modifies the host project's dependencies, creating a concrete install-time capability risk. The fixed dependency list aligns with the SDK's React Native and Expo purpose, so the source supports a warning rather than a block.
Evidence
package.jsoninstall-peers.js
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs install-peers.js during postinstall.
- The installer reads the host package and skips when the host is floating-games-sdk.
- After a delay, it runs npx expo install in the host project for a fixed set of dependencies.
- This automatically changes the consumer project during installation; the inspected source does not establish credential theft or remote code delivery.
Evidence against
- The install list is composed of React Native and Expo dependencies relevant to the SDK.
- The runtime API uses a fixed service endpoint for game and balance requests.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node install-peers.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkginstall-peers.jsView file
1const { execSync } = require('child_process');
L2: const path = require('path');
High
45windowsHide: true,
L46: shell: true
L47: });
High
40try {
L41: execSync(`npx expo install ${packages} --legacy-peer-deps`, {
L42: stdio: 'inherit',
Findings
5 High4 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processinstall-peers.js
HighShellinstall-peers.js
HighRuntime Package Installinstall-peers.js
HighKnown Malware Source Similarityinstall-peers.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to floating-games-sdk@1.0.38.
See all versions of floating-games-sdk for other recorded verdicts.
- Review the evidence and your use of floating-games-sdk@1.0.38 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.