react-native-drago-callkit@1.0.1
OpenSSF/OSV Malicious Advisory
imported 6d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18394 confirms this npm version as malicious.
Advisory
MAL-2026-18394
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in react-native-drago-callkit (npm)
Details
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
References
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
The install hook is an automatic side effect, but inspected helpers make bounded, package-aligned Android CallKit changes and preserve backups. The runtime entrypoint delegates explicit API calls to the native module, and the flagged build archive does not establish an attack.
Static reason
One or more suspicious static signals were detected.
Trigger
The postinstall hook runs during package installation.
Impact
The inspected behavior configures the consumer app for CallKit; it does not establish credential collection, unrelated network transfer, or destructive changes.
Mechanism
Its helpers create missing Android bridge files and patch MainActivity and MainApplication for call handling, with backups for patched files.
AI rationale
The install hook is an automatic side effect, but inspected helpers make bounded, package-aligned Android CallKit changes and preserve backups. The runtime entrypoint delegates explicit API calls to the native module, and the flagged build archive does not establish an attack.
Evidence
scripts/postinstall.jsscripts/create-applauncher-files.jsscripts/patch-mainactivity.jsscripts/patch-mainapplication.js
Independent scan evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json runs a postinstall setup script and exposes dist/index.js as the runtime entrypoint.
- dist/index.js forwards explicit CallKit API calls to the native module.
- scripts/postinstall.js invokes helpers to create bridge files and patch Android app sources.
- The flagged archive is identified as a ZIP build artifact; its analysis does not establish runtime loading.
- The patch helper backs up MainActivity before writing its CallKit changes.
- The file creation helper leaves an existing AppLauncher module unchanged.
Evidence against
- The postinstall hook automatically modifies consumer Android source files, though the inspected changes are scoped to CallKit setup.
Behavioral surface
ChildProcessFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js || exit 0
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js || exit 0
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.jsView file
7Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: execution+network
L7:
L8: const { execSync } = require('child_process');
L9: const path = require('path');
...
L48: console.log('\n📝 Please follow manual setup instructions:');
L49: console.log(' https://github.com/dragocallkit/react-native-drago-callkit#manual-setup\n');
L50:
Findings
4 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighEntrypoint Build Divergencescripts/postinstall.js
HighPayload In Excluded Dirandroid/build/.transforms/16dd1d227ecd26c940a6e45c02ed0fde/transformed/bundleLibRuntimeToDirDebug/bundleLibRuntimeToDirDebug_global-synthetics/com/dragocallkit/CallService$$InternalSyntheticLambda$2$5d69151837850ce5c931c0a15c5620e4bf1e58ff7a271e09972ff66172e58280$0.globals
HighSemantic Analysis Limiteddist/index.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumShips Native Binaryandroid/build/intermediates/runtime_library_classes_dir/debug/bundleLibRuntimeToDirDebug/com/dragocallkit/Constants.class
MediumShips Compressed Blobandroid/build/.transforms/16dd1d227ecd26c940a6e45c02ed0fde/transformed/bundleLibRuntimeToDirDebug/bundleLibRuntimeToDirDebug_global-synthetics/com/dragocallkit/CallService$$InternalSyntheticLambda$2$5d69151837850ce5c931c0a15c5620e4bf1e58ff7a271e09972ff66172e58280$0.globals
Affected versions and remediation
This report applies to react-native-drago-callkit@1.0.1.
See all versions of react-native-drago-callkit for other recorded verdicts.
- Avoid installing react-native-drago-callkit@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.