registry / rn-push-provisioning / 99.0.2

rn-push-provisioning@99.0.2

Security research - dependency confusion proof of concept. Contact: liquid2@liquidsec.net

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installation silently fingerprints the machine and transmits the data to an external server. Errors are suppressed and the lifecycle command is allowed to succeed.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation, before the package is installed.

Impact

Leaks the installing host name, user name, platform, and CPU architecture to a third party.

Mechanism

Preinstall host fingerprinting and HTTP exfiltration.

Attack narrative

When npm installs the package, its preinstall hook executes beacon.js. The script gathers local host and user identifiers plus platform metadata, then sends them to a hard-coded IP address over unencrypted HTTP. The hook suppresses network errors and uses a shell fallback so installation can continue without notifying the user.

Rationale

This is unconsented install-time collection and transmission of local system identity data to a hard-coded external endpoint. The package has no legitimate implementation beyond this beacon.

Evidence

package.jsonbeacon.jsindex.js

Network endpoints1

104.236.2.79:8888/npm-install

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence with false-positive risk.

rn-push-provisioning@99.0.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code