hyperion-react-native-testapp

{"schema_version":"1.7.4","id":"MAL-2025-6727","published":"2025-07-28T18:03:36Z","modified":"2026-08-25T08:22:30.211275124Z","summary":"Malicious code in hyperion-react-native-testapp (npm)","details":"The package communicates with a domain associated with malicious activity.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (09dade0de8238a15a0ae8541c47a5178f3234eb654cc6afe58eaf02600ad4d47)\npackage.json declares a preinstall lifecycle script that runs `wget` at npm install time, sending the installer's username ($(whoami)), current working directory ($(pwd)), and hostname ($(hostname)) as URL query parameters to a hardcoded webhook.site collector (https://webhook.site/c4919b2f-dd76-4a2f-adca-2f052bc8ff0e/). This fires unconditionally on `npm install` without user consent and delivers installer identity/environment data to a third-party collector controlled by whoever created the webhook. The package name pattern and beacon shape are consistent with a dependency-confusion proof-of-concept, but the exfiltration behavior is real regardless of intent.\n","affected":[{"package":{"name":"hyperion-react-native-testapp","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0"}]}],"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"2486f7fd625a5fcab7da2c2a5a65b5b54afb420976be20dad3b3298cfd59c01a","tlsh":"d80199b5a2316e7306c68ab11570422fe662f79b92162d1dbba32219a32ecb2107c515"}],"package_integrity":[{"filename":"hyperion-react-native-testapp-1.0.0.tgz","hashes":{"sha1":"6d333fefe66bde78f58f733d0eb05a16116cb782","sha512_sri":"sha512-7b8FQfCIVq91QL2kFPXY4Z9DPCF/9C1mJ9tGNcSGea6rrvmDtLfhAaOH2J0U9rifLQ2Z1Rd3K2SI/y9OMtAW3w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/hyperion-react-native-testapp/v/1.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018696","import_time":"2026-08-25T08:20:36.285672531Z","modified_time":"2026-08-25T07:59:17Z","sha256":"09dade0de8238a15a0ae8541c47a5178f3234eb654cc6afe58eaf02600ad4d47","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com","inspector-research@amazon.com"],"type":"FINDER"}]}