hyperion-react-native-testapp

GHSA-q4j8-mj3q-r8wq

Malicious code in hyperion-react-native-testapp (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

The package communicates with a domain associated with malicious activity.## Source: amazon-inspector (09dade0de8238a15a0ae8541c47a5178f3234eb654cc6afe58eaf02600ad4d47)
package.json declares a preinstall lifecycle script that runs `wget` at npm install time, sending the installer's username ($(whoami)), current working directory ($(pwd)), and hostname ($(hostname)) as URL query parameters to a hardcoded webhook.site collector (https://webhook.site/c4919b2f-dd76-4a2f-adca-2f052bc8ff0e/). This fires unconditionally on `npm install` without user consent and delivers installer identity/environment data to a third-party collector controlled by whoever created the webhook. The package name pattern and beacon shape are consistent with a dependency-confusion proof-of-concept, but the exfiltration behavior is real regardless of intent.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/89c0753961091b435fe2df72cc6bc9332fa406e4/osv/malicious/npm/hyperion-react-native-testapp/MAL-2025-6727.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/89c0753961091b435fe2df72cc6bc9332fa406e4/osv/malicious/npm/hyperion-react-native-testapp/MAL-2025-6727.json
- https://www.npmjs.com/package/hyperion-react-native-testapp/v/1.0.0
- https://github.com/ossf/malicious-packages/blob/05b419acdcdd6e02782971da765f32a22a1aed8e/osv/malicious/npm/hyperion-react-native-testapp/MAL-2025-6727.json
- https://github.com/advisories/GHSA-q4j8-mj3q-r8wq

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.