registry / Remote code execution / react-native-ui-message

react-native-ui-message

A simple, flexible, and customizable React Native UI messaging solution for creating elegant toast notifications, in-app alerts, and user feedback experiences

This report shows the evidence for react-native-ui-message@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is a concrete install-time fingerprinting and remote-code-execution chain unrelated to a React Native toast library. The fake integrity verification provides no meaningful protection.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

Remote operator can execute arbitrary Node-capable payloads during installation and receive host identifiers.

Mechanism

host fingerprinting followed by remotely supplied code execution

Attack narrative

Installing the package invokes SubscriptionGuard.js. It sends the host MAC address, platform, and local package path to a remote entitlement endpoint, then fetches JavaScript from that service. A nonfunctional hard-coded hash check always passes, and the code is run in a VM context exposing require and process, enabling remote arbitrary code execution at install time.

AI rationale

This is a concrete install-time fingerprinting and remote-code-execution chain unrelated to a React Native toast library. The fake integrity verification provides no meaningful protection.

Evidence

package.jsonsrc/utilities/SubscriptionGuard.jsindex.js

Network endpoints2

react-native-ui-message.com/api/EntitlementStatereact-native-ui-message.com/api/ValidateLicense/{token}/{result}

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json postinstall runs SubscriptionGuard.js automatically.
SubscriptionGuard.js collects MAC address, OS, and package path.
It POSTs host data to the package-controlled entitlement endpoint.
It GETs server-provided JavaScript and executes it with vm.runInContext.
The purported hash check compares two hard-coded identical values, so it does not validate remote code.
VM context exposes require, process, Buffer, and timers to remote code.

Evidence against

index.js itself only exports UI library modules; the harmful path is install-time.

Behavioral surface

Source

CryptoNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 29 file(s), 37.5 KB of source, external domains: react-native-ui-message.com

Source & flagged code

4 flagged

package.jsonView file

•scripts.postinstall = npm run check:subscription

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = npm run check:subscription

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/utilities/SubscriptionGuard.jsView file

1const process = require("process"); L2: const axios = require("axios"); L3: const os = require("os"); ... L30: async function getMacAddress() { L31: const interfaces = os.networkInterfaces(); L32: ... L52: L53: const params = new URLSearchParams({ L54: os: process.platform, L55: path: __dirname,

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

src/utilities/SubscriptionGuard.jsView on unpkg · L1

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

src/utilities/SubscriptionGuard.jsView on unpkg · L1

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = npm run check:subscription

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = npm run check:subscription

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/utilities/SubscriptionGuard.jsView file

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

Findings

2 High3 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHost Fingerprint Exfiltrationsrc/utilities/SubscriptionGuard.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumUnsafe Vm Contextsrc/utilities/SubscriptionGuard.js

MediumNetwork

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to react-native-ui-message@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing react-native-ui-message@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-21 12:30:11.126Z (UTC).

Source advisory published: 2026-08-05 12:57:43.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.0.1-securitylatestClean—AllowPublishedAug 21, 2026, 11:42 AM 1.0.0shownMaliciousRemote Code ExecutionBlockPublishedJul 21, 2026, 1:24 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Runtime surface

Behavioral surface

Source & flagged code

Related packages

Other remote code execution packages