registry / react-flying-reaction / 3.0.1

react-flying-reaction@3.0.1

React flying reaction

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Rendering the component triggers remote license validation. If validation fails on a non-localhost site, it empties the host application's body.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer mounts Reaction with an invalid, expired, revoked, or unavailable license result.

Impact

It can destroy the visible content and operation of the consumer's web application.

Mechanism

Obfuscated license gate that replaces the document body.

Attack narrative

The package performs a license check when Reaction is mounted. On a non-localhost host, an invalid result causes it to create an empty body and replace the application's existing body. This is unrelated to rendering flying emoji and is hidden in an obfuscated bundle; it can take down any page using the component.

Rationale

The component contains a concrete, destructive action against the consuming application's DOM, guarded only by remote-controlled license status. No install hook is needed for this harmful runtime behavior.

Evidence

index.jsdocument.documentElementdocument.body

Network endpoints1

api.npoint.io/f63d2269d3d045f8cdc3

Decision evidence

public snapshot

AI called this at 98.0% confidence with false-positive risk.

react-flying-reaction@3.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code