react-native-bright-sdk@9000.0.0
Namespace reservation / canary. Contains no functional code.
AI Security Review
scanned 3h ago · by lpm-firewall-aiThe manifest activates an install-time script that sends host-identifying data to an external collector. This unconsented installation disclosure supports blocking publication.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation runs the preinstall hook.
Impact
The endpoint receives identifying installation telemetry without installer consent.
Mechanism
The hook collects the hostname and timestamp, encodes them, and sends them in an HTTPS request without a consent guard.
Attack narrative
Installing the package runs canary.js through its preinstall hook. That script sends the machine hostname and installation timestamp to an external ngrok endpoint without an installer-consent guard.
AI rationale
The manifest activates an install-time script that sends host-identifying data to an external collector. This unconsented installation disclosure supports blocking publication.
Evidence
package.jsoncanary.js
Network endpoints1
estimator-nemeses-unwatched.ngrok-free.dev
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package runs canary.js from an automatic preinstall hook.
- The hook sends the machine hostname and install timestamp to an external ngrok endpoint without an installer-consent guard.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node canary.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg5"scripts": {
"preinstall": "node canary.js"
},
"license
High
Suspicious Lifecycle Evidence
The package runs canary.js from an automatic preinstall hook.
package.jsonView on unpkg · L5canary.jsView file
5const payload = {
event: 'install',
host: os.hostname(),
ts: new Date().toISOString()
};
const data = Buffer.from(JSON.stringify(payload)).toString('base64');
// свой собственный сервер/webhook, который ты контролируеш
High
Ai Review Evidence
The hook sends the machine hostname and install timestamp to an external ngrok endpoint without an installer-consent guard.
canary.jsView on unpkg · L5Findings
4 High1 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencecanary.js
HighAi Review Evidencecanary.js
MediumNetwork
LowScripts Present
LowUrl Strings
Affected versions and remediation
This report applies to react-native-bright-sdk@9000.0.0.
See all versions of react-native-bright-sdk for other recorded verdicts.
- Avoid installing react-native-bright-sdk@9000.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.