react-native-drago-callkit@1.0.15
OpenSSF/OSV Malicious Advisory
imported 6d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18394 confirms this npm version as malicious.
Advisory
MAL-2026-18394
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in react-native-drago-callkit (npm)
Details
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
References
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
The default postinstall path exits without changing project files, and the gated setup implements Android call integration. The flagged generated binary artifact was unreadable, but the available source and entry-point behavior did not indicate an attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Importing the entry point initializes the React Native bridge; project file setup requires DRAGO_CALLKIT_SETUP=true or an explicit setup command.
Impact
The inspected behavior supports the package’s stated calling features; no unrelated data transfer or destructive behavior was found.
Mechanism
The optional setup creates native helper files and patches Android activity and application code to handle calls.
AI rationale
The default postinstall path exits without changing project files, and the gated setup implements Android call integration. The flagged generated binary artifact was unreadable, but the available source and entry-point behavior did not indicate an attack.
Independent scan evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest’s postinstall hook runs a script that exits unless DRAGO_CALLKIT_SETUP=true; setup is also exposed as an explicit npm command.
- When enabled, setup creates Android AppLauncher files and patches the consuming app’s MainActivity and MainApplication for call handling.
- The JavaScript entry point imports React Native and exposes CallKit methods through the native module; no unrelated import-time behavior was identified.
- Searches of Android source found no external network endpoints, credential references, or shell execution.
Evidence against
- The package declares a postinstall lifecycle script, so its default behavior needed review.
- A flagged generated .globals artifact was binary and could not be read by the source inspection tool; the package also includes readable Android implementation source.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js || exit 0
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js || exit 0
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.jsView file
17Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network
L17: // Check if user wants automatic setup
L18: if (process.env.DRAGO_CALLKIT_SETUP !== 'true') {
L19: console.log('\n📦 react-native-drago-callkit installed successfully!');
...
L25:
L26: const { execSync } = require('child_process');
L27: const path = require('path');
...
L66: console.log('\n📝 Please follow manual setup instructions:');
L67: console.log(' https://github.com/dragocallkit/react-native-drago-callkit#manual-setup\n');
L68:
Findings
5 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighEntrypoint Build Divergencescripts/postinstall.js
HighPayload In Excluded Dirandroid/build/.transforms/16dd1d227ecd26c940a6e45c02ed0fde/transformed/bundleLibRuntimeToDirDebug/bundleLibRuntimeToDirDebug_global-synthetics/com/dragocallkit/CallService$$InternalSyntheticLambda$2$5d69151837850ce5c931c0a15c5620e4bf1e58ff7a271e09972ff66172e58280$0.globals
HighSemantic Analysis Limiteddist/index.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltascripts/postinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Native Binaryandroid/build/intermediates/runtime_library_classes_dir/debug/bundleLibRuntimeToDirDebug/com/dragocallkit/Constants.class
MediumShips Compressed Blob
Affected versions and remediation
This report applies to react-native-drago-callkit@1.0.15.
See all versions of react-native-drago-callkit for other recorded verdicts.
- Avoid installing react-native-drago-callkit@1.0.15. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.