registry / react-flying-reaction / 2.0.4

react-flying-reaction@2.0.4

React flying reaction

AI Security Review

scanned 10h ago · by lpm-firewall-ai

Importing and mounting the component runs concealed license verification. It may contact a third-party revocation endpoint and uses browser properties to control whether the component renders.

Static reason

One or more suspicious static signals were detected.

Trigger

A React application mounts the default Reaction component.

Impact

Applications may make an undisclosed third-party request and have rendering controlled by opaque code; no direct data exfiltration was confirmed.

Mechanism

Obfuscated browser fingerprinting and remote license-revocation checking.

Rationale

No install-time execution or confirmed exfiltration was found, so the evidence does not support a malicious verdict. The concealed remote licensing and fingerprint-derived render gate are not aligned with the stated component and warrant a warning.

Evidence

index.js

Network endpoints1

api.npoint.io/f63d2269d3d045f8cdc3

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Unknown with low false-positive risk.

Evidence for warning

The runtime entry is a deliberately obfuscated single-line bundle that hides its actual browser behavior.

react-flying-reaction@2.0.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code