react-native-bright-sdk

GHSA-fjcx-639f-h39g

Malicious code in react-native-bright-sdk (npm)

Details

**Severity:** Critical

**Affected versions:** `= 9000.0.0`

## Source: amazon-inspector (4208eebeabe05114e68e0b4abf11c9ff176594200c28400fe5c82deb3a5c8f55)
The package declares a preinstall lifecycle hook that executes canary.js on `npm install`. The script collects os.hostname() and an install timestamp, base64-encodes the JSON payload, and transmits it via HTTPS GET to the hardcoded endpoint https://estimator-nemeses-unwatched.ngrok-free.dev/canary. The destination is an anonymous, ephemeral ngrok tunnel unrelated to any legitimate publisher infrastructure, and the beacon fires automatically without user opt-in. The package ships no functional code justifying this network activity; it exists only to send the install signal. The version number (9000.0.0) and name resemble a dependency-confusion / namespace-reservation shape targeting internal package resolution.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/b711d7c76f98b5044512e8c851547e8a05b2f959/osv/malicious/npm/react-native-bright-sdk/MAL-2026-18290.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/b711d7c76f98b5044512e8c851547e8a05b2f959/osv/malicious/npm/react-native-bright-sdk/MAL-2026-18290.json
- https://www.npmjs.com/package/react-native-bright-sdk/v/9000.0.0
- https://github.com/ossf/malicious-packages/blob/c55d8cc75d35594b1dc96812e6983993f6a4cfa0/osv/malicious/npm/react-native-bright-sdk/MAL-2026-18290.json
- https://github.com/advisories/GHSA-fjcx-639f-h39g

Compromised versions (1)

= 9000.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.