react-native-drago-callkit@1.0.2
OpenSSF/OSV Malicious Advisory
imported 6d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18394 confirms this npm version as malicious.
Advisory
MAL-2026-18394
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in react-native-drago-callkit (npm)
Details
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
References
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
The automatic postinstall edits consumer Android source, but the scripts and generated code serve this package’s documented CallKit integration and are bounded to app launcher and lifecycle setup. The reviewed JavaScript entry point is a native-module bridge, and searches of Android source found no external HTTP client or URL connection behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall, or an explicit manual run of scripts/postinstall.js.
Impact
The reviewed actions are limited to CallKit integration in the consumer app; no unrelated host contact or credential handling was identified.
Mechanism
Creates missing AppLauncher files and patches matching MainActivity and MainApplication source files, saving backups before the latter changes.
AI rationale
The automatic postinstall edits consumer Android source, but the scripts and generated code serve this package’s documented CallKit integration and are bounded to app launcher and lifecycle setup. The reviewed JavaScript entry point is a native-module bridge, and searches of Android source found no external HTTP client or URL connection behavior.
Evidence
scripts/create-applauncher-files.jsscripts/patch-mainactivity.jsscripts/patch-mainapplication.jsMainActivity.ktMainApplication.ktAppLauncherModule.ktAppLauncherPackage.kt
Independent scan evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The install hook invokes only the package’s Android CallKit setup scripts.
- Launcher source files are created only if they do not already exist.
- Existing MainActivity and MainApplication files are backed up before being patched.
- The JavaScript entry point exposes a React Native native-module bridge for CallKit.
Evidence against
- postinstall runs automatically and modifies matching host-app source files.
- The snapshot includes compiled Android artifacts that are not directly readable, though corresponding Kotlin source is present.
Behavioral surface
ChildProcessFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js || exit 0
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js || exit 0
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.jsView file
7Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: execution+network
L7:
L8: const { execSync } = require('child_process');
L9: const path = require('path');
...
L48: console.log('\n📝 Please follow manual setup instructions:');
L49: console.log(' https://github.com/dragocallkit/react-native-drago-callkit#manual-setup\n');
L50:
Findings
4 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighEntrypoint Build Divergencescripts/postinstall.js
HighPayload In Excluded Dirandroid/build/.transforms/16dd1d227ecd26c940a6e45c02ed0fde/transformed/bundleLibRuntimeToDirDebug/bundleLibRuntimeToDirDebug_global-synthetics/com/dragocallkit/CallService$$InternalSyntheticLambda$2$5d69151837850ce5c931c0a15c5620e4bf1e58ff7a271e09972ff66172e58280$0.globals
HighSemantic Analysis Limiteddist/index.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumShips Native Binaryandroid/build/intermediates/runtime_library_classes_dir/debug/bundleLibRuntimeToDirDebug/com/dragocallkit/Constants.class
MediumShips Compressed Blobandroid/build/.transforms/16dd1d227ecd26c940a6e45c02ed0fde/transformed/bundleLibRuntimeToDirDebug/bundleLibRuntimeToDirDebug_global-synthetics/com/dragocallkit/CallService$$InternalSyntheticLambda$2$5d69151837850ce5c931c0a15c5620e4bf1e58ff7a271e09972ff66172e58280$0.globals
Affected versions and remediation
This report applies to react-native-drago-callkit@1.0.2.
See all versions of react-native-drago-callkit for other recorded verdicts.
- Avoid installing react-native-drago-callkit@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.