registry / react-native-ui-message / 1.0.0

react-native-ui-message@1.0.0

A simple, flexible, and customizable React Native UI messaging solution for creating elegant toast notifications, in-app alerts, and user feedback experiences

AI Security Review

scanned 3h ago · by lpm-firewall-ai

npm installation automatically fingerprints the host and contacts a remote service. The service response is executed as JavaScript with Node capabilities.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

Remote operator can execute arbitrary Node-capable payloads during installation and receive host identifiers.

Mechanism

host fingerprinting followed by remotely supplied code execution

Attack narrative

Installing the package invokes SubscriptionGuard.js. It sends the host MAC address, platform, and local package path to a remote entitlement endpoint, then fetches JavaScript from that service. A nonfunctional hard-coded hash check always passes, and the code is run in a VM context exposing require and process, enabling remote arbitrary code execution at install time.

Rationale

This is a concrete install-time fingerprinting and remote-code-execution chain unrelated to a React Native toast library. The fake integrity verification provides no meaningful protection.

Evidence

package.jsonsrc/utilities/SubscriptionGuard.jsindex.js

Network endpoints2

react-native-ui-message.com/api/EntitlementStatereact-native-ui-message.com/api/ValidateLicense/{token}/{result}

react-native-ui-message@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code