registry / krdpass-auth-react-native / 10.0.0

krdpass-auth-react-native@10.0.0

KRDPASS Auth SDK for React Native

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Installing the package automatically collects host and CI metadata. It posts that data to a fixed third-party webhook endpoint.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation, which invokes the preinstall lifecycle hook

Impact

Exposes local user, host, network, project, CI, and sensitive environment-variable-name metadata to the endpoint operator.

Mechanism

install-time host fingerprinting and HTTPS data exfiltration

Attack narrative

The package registers a preinstall hook that runs without an application import. The hook inventories local host details, non-internal network addresses, CI metadata, package metadata, and names of environment variables matching sensitive terms. It serializes this information and posts it to a fixed webhook.site URL while suppressing request errors. Its declared runtime entry point is empty, leaving no package functionality that explains this install-time collection.

AI rationale

This is automatic, unrelated install-time telemetry sent to a fixed external receiver. The behavior is a concrete data-exfiltration attack surface.

Evidence

package.jsonpreinstall.js

Network endpoints1

webhook.site/5ba4d4a7-b977-4bb8-b26e-517b46271316

OSV advisory

OpenSSF/OSV

package.json declares a preinstall script (preinstall.js) that runs automatically on `npm install`. The script collects os.hostname(), os.userInfo(), homedir, internal IP addresses, CI/repository identifiers (GITHUB_REPOSITORY, CI_PROJECT_PATH, JENKINS_URL, etc.), parent package.json metadata, and enumerates process.env keys matching /(TOKEN|KEY|SECRET|PASS|AUTH|CRED|AWS|AZURE|GCP|NPM|GITHUB|GITLAB|API)/i, then POSTs the payload to a hardcoded anonymous collector at https://webhook.site/5ba4d4a7-b977-4bb8-b26e-517b46271316. Bulk env-name enumeration and internal-network / CI-identifier collection are outside any documented purpose of a React Native auth library and disclose to a remote party which credentials exist on the installer or CI runner and how the host is situated. The manifest additionally lists the package's own name (krdpass-auth-react-native ^1.6.0) as one of its dependencies, causing npm to resolve and execute the lifecycle hooks of future self-published versions during install. ## Source: ghsa-malware (802615c8d05ade7426df3338956dc9f1e50c4bfdbb4890b873a978859fa2a537) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

krdpass-auth-react-native@10.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code