react-native-drago-callkit@1.0.16
OpenSSF/OSV Malicious Advisory
imported 6d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18394 confirms this npm version as malicious.
Advisory
MAL-2026-18394
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in react-native-drago-callkit (npm)
Details
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
References
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
The install hook does not perform setup by default and only modifies the consuming app's Android files after explicit opt-in. The entry point and native sources reviewed align with the package's call integration purpose, with no unrelated network or credential behavior found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Installation runs postinstall, which exits unless DRAGO_CALLKIT_SETUP=true; the setup script can also be invoked explicitly.
Impact
No malicious impact identified. Explicitly enabled setup changes the consuming app's Android source files to integrate call handling.
Mechanism
Opted-in setup creates or patches Android CallKit integration files and saves backups. No unrelated network, credential, or destructive behavior was identified.
AI rationale
The install hook does not perform setup by default and only modifies the consuming app's Android files after explicit opt-in. The entry point and native sources reviewed align with the package's call integration purpose, with no unrelated network or credential behavior found.
Independent scan evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall hook exits unless DRAGO_CALLKIT_SETUP is explicitly set to true; the setup command sets that variable explicitly.
- When enabled, setup creates AppLauncher files and patches Android app files for CallKit integration.
- The setup helpers write the Android integration files and create backups of files they patch.
- The JavaScript entry point initializes the React Native bridge and exports call-related methods; no unrelated automatic behavior was identified.
Evidence against
- The package declares postinstall and prepare lifecycle scripts.
- The opt-in setup modifies Android project files outside the package directory.
- The package includes generated Android build artifacts alongside readable native source.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js || exit 0
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js || exit 0
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.jsView file
17Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network
L17: // Check if user wants automatic setup
L18: if (process.env.DRAGO_CALLKIT_SETUP !== 'true') {
L19: console.log('\n📦 react-native-drago-callkit installed successfully!');
...
L25:
L26: const { execSync } = require('child_process');
L27: const path = require('path');
...
L66: console.log('\n📝 Please follow manual setup instructions:');
L67: console.log(' https://github.com/dragocallkit/react-native-drago-callkit#manual-setup\n');
L68:
Findings
5 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighEntrypoint Build Divergencescripts/postinstall.js
HighPayload In Excluded Dirandroid/build/.transforms/16dd1d227ecd26c940a6e45c02ed0fde/transformed/bundleLibRuntimeToDirDebug/bundleLibRuntimeToDirDebug_global-synthetics/com/dragocallkit/CallService$$InternalSyntheticLambda$2$5d69151837850ce5c931c0a15c5620e4bf1e58ff7a271e09972ff66172e58280$0.globals
HighSemantic Analysis Limiteddist/index.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltascripts/postinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Native Binaryandroid/build/intermediates/runtime_library_classes_dir/debug/bundleLibRuntimeToDirDebug/com/dragocallkit/Constants.class
MediumShips Compressed Blob
Affected versions and remediation
This report applies to react-native-drago-callkit@1.0.16.
See all versions of react-native-drago-callkit for other recorded verdicts.
- Avoid installing react-native-drago-callkit@1.0.16. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.