registry / react-flying-reaction / 3.0.0

react-flying-reaction@3.0.0

React flying reaction

AI Security Review

scanned 4h ago · by lpm-firewall-ai

When the React component mounts, it performs a remote license-revocation check. A failed check outside localhost replaces the host page body, disrupting the consuming application.

Static reason

One or more suspicious static signals were detected.

Trigger

Mounting the Reaction component in a browser.

Impact

A remote revocation response or invalid key can blank or replace the consumer application's page.

Mechanism

Obfuscated remote license gate followed by document-body replacement.

Attack narrative

The package hides a license and revocation system inside an emoji-animation component. On mount it fetches a remote revocation list. If the license is invalid and the host is not localhost, the obfuscated code creates replacement markup and replaces the document body. This lets package-controlled remote state disrupt an application that imports and renders the component.

Rationale

This is concrete destructive runtime behavior unrelated to a flying-reaction UI, concealed by obfuscation and controlled by a remote endpoint. The absence of an install hook does not mitigate the browser-page replacement.

Evidence

index.js

Network endpoints1

api.npoint.io/f63d2269d3d045f8cdc3

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The sole runtime file is deliberately obfuscated, hiding non-UI licensing and browser-control code.
The component fetches a remotely controlled revocation list during use.
An invalid remote or local license on a non-localhost page causes the code to replace the document body.
The package is presented as a simple emoji animation but contains hidden remote gating and destructive page mutation.

Evidence against

package.json has no install lifecycle scripts.
The manifest declares React as a peer dependency and exposes a React entry point.

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsMinifiedObfuscatedTrivialUrlStrings

Manifest

NoLicense

scanned 1 file(s), 52.5 KB of source, external domains: api.npoint.io, stackoverflow.com

Source & flagged code

5 flagged

index.jsView file

Lines 1-2javascript

1function _0x5d34(){const _0x5aeb5e=['styleId','_fromServer','default','env','length','bigint','optimizeForSpeed','_name','createContext','getSheetForTag','expiresAt','BASE','payload','`setOptimizeForSpeed`\x20accepts\x20a\x20boolean','call','defineProperty','keys','hashable','split','map','prototype','_indices','removeChild','assertValidity','status','toAffine','slice','checkedAt','fromAffine','pixelDepth','141WGnXlz','filter','clearCofactor','`insertRule`\x20accepts\x20only\x20strings','set','_rulesCount','_nonce','bad\x20number:\x20out\x20of\x20range','selectFromServer','transaction','styleI ...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.jsView on unpkg · L1

High

Ai Review Evidence

The sole runtime file is deliberately obfuscated, hiding non-UI licensing and browser-control code.

index.jsView on unpkg · L1

High

Ai Review Evidence

The component fetches a remotely controlled revocation list during use.

index.jsView on unpkg · L1

High

Ai Review Evidence

An invalid remote or local license on a non-localhost page causes the code to replace the document body.

index.jsView on unpkg · L1

Long lines were clipped for display.

index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.js#virtual:normalized:round1View on unpkg

Source & flagged code

5 flagged · loading source

index.jsView file

1function _0x5d34(){const _0x5aeb5e=['styleId','_fromServer','default','env','length','bigint','optimizeForSpeed','_name','createContext','getSheetForTag','expiresAt','BASE','payloa...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.jsView on unpkg · L1

1function _0x5d34(){const _0x5aeb5e=['styleId','_fromServer','default','env','length','bigint','optimizeForSpeed','_name','createContext','getSheetForTag','expiresAt','BASE','payload'

High

Ai Review Evidence

The sole runtime file is deliberately obfuscated, hiding non-UI licensing and browser-control code.

index.jsView on unpkg · L1

1fetch(REVOKED_LIST_URL,{'cache':'no-store'})

High

Ai Review Evidence

The component fetches a remotely controlled revocation list during use.

index.jsView on unpkg · L1

1if(_0x29f19f['status']==='invalid'&&!_0x23ec98){const _0x1818f7=document[_0x273c02(0x227)](_0x273c02(0x244));return _0x1818f7['innerHTML']=_0x273c02(0x229),document[_0x273c02(0x1d6)][_0x273c02(0x23e)](_0x1818f7,document[_0x273c02(0x244)]),null;}

High

Ai Review Evidence

An invalid remote or local license on a non-localhost page causes the code to replace the document body.

index.jsView on unpkg · L1

index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.js#virtual:normalized:round1View on unpkg

Findings

6 High2 Medium3 Low

HighObfuscated Payload Loaderindex.js

HighObfuscated

HighSemantic Analysis Limitedindex.js#virtual:normalized:round1

HighAi Review Evidenceindex.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowUrl Strings

LowNo License