registry / react-flying-reaction / 2.0.5

react-flying-reaction@2.0.5

React flying reaction

AI Security Review

scanned 10h ago · by lpm-firewall-ai

Using the React component triggers an external license-revocation request and local IndexedDB caching. The remote result can disable the component, but no code execution or data exfiltration was confirmed.

Static reason

One or more suspicious static signals were detected.

Trigger

Mounting the Reaction component in a browser.

Impact

A third-party endpoint can remotely prevent the component from rendering; the opaque implementation leaves residual audit risk.

Mechanism

Obfuscated browser-side license verification with a remote revocation list.

Rationale

This is suspicious because a heavily obfuscated animation package contains remotely controlled license enforcement and browser fingerprint-like logic. Static inspection found no concrete malicious execution, collection, or install-time behavior, so blocking is not justified.

Evidence

index.jslicense/verify.d.ts

Network endpoints1

api.npoint.io/f63d2269d3d045f8cdc3

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The 53 KB single-line index.js is deliberately obfuscated, which prevents straightforward auditing of its browser behavior.

react-flying-reaction@2.0.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code