react-native-drago-callkit@1.0.0
OpenSSF/OSV Malicious Advisory
imported 6d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18394 confirms this npm version as malicious.
Advisory
MAL-2026-18394
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in react-native-drago-callkit (npm)
Details
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
References
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
The automatic hook does modify consumer Android source, but the inspected changes implement the package’s stated CallKit integration and create backups. The runtime entrypoint forwards calls to the native module, and the inspected artifact analysis did not establish attack behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
The setup script runs during package installation.
Impact
The intended effect is to add CallKit support to the consumer’s Android app; no attack impact was established.
Mechanism
It creates launcher files and patches Android app classes, saving backups before modifying existing source.
AI rationale
The automatic hook does modify consumer Android source, but the inspected changes implement the package’s stated CallKit integration and create backups. The runtime entrypoint forwards calls to the native module, and the inspected artifact analysis did not establish attack behavior.
Evidence
package.jsonscripts/postinstall.jsscripts/create-applauncher-files.jsscripts/patch-mainactivity.jsscripts/patch-mainapplication.jsdist/index.js.lpm-inspection-efJRyo/0-82ea319f11ba.txt
Independent scan evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json runs scripts/postinstall.js automatically during installation.
- The install script calls helpers that create AppLauncher files and patch the Android app classes.
- The MainActivity patch writes updated source after creating a backup.
- The MainApplication patch writes updated source after creating a backup.
- The runtime entrypoint forwards incoming-call requests to the native CallKit module.
- The inspected artifact analysis identifies ZIP data and notes that package execution and network access were disabled.
Evidence against
- The install hook automatically changes consumer Android project source files.
Behavioral surface
ChildProcessFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js || exit 0
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js || exit 0
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.jsView file
7Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: execution+network
L7:
L8: const { execSync } = require('child_process');
L9: const path = require('path');
...
L48: console.log('\n📝 Please follow manual setup instructions:');
L49: console.log(' https://github.com/dragocallkit/react-native-drago-callkit#manual-setup\n');
L50:
Findings
4 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighEntrypoint Build Divergencescripts/postinstall.js
HighPayload In Excluded Dirandroid/build/.transforms/16dd1d227ecd26c940a6e45c02ed0fde/transformed/bundleLibRuntimeToDirDebug/bundleLibRuntimeToDirDebug_global-synthetics/com/dragocallkit/CallService$$InternalSyntheticLambda$2$5d69151837850ce5c931c0a15c5620e4bf1e58ff7a271e09972ff66172e58280$0.globals
HighSemantic Analysis Limiteddist/index.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumShips Native Binaryandroid/build/intermediates/runtime_library_classes_dir/debug/bundleLibRuntimeToDirDebug/com/dragocallkit/Constants.class
MediumShips Compressed Blobandroid/build/.transforms/16dd1d227ecd26c940a6e45c02ed0fde/transformed/bundleLibRuntimeToDirDebug/bundleLibRuntimeToDirDebug_global-synthetics/com/dragocallkit/CallService$$InternalSyntheticLambda$2$5d69151837850ce5c931c0a15c5620e4bf1e58ff7a271e09972ff66172e58280$0.globals
Affected versions and remediation
This report applies to react-native-drago-callkit@1.0.0.
See all versions of react-native-drago-callkit for other recorded verdicts.
- Avoid installing react-native-drago-callkit@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.