hyperion-react-native-testapp

Details

The package communicates with a domain associated with malicious activity.

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (09dade0de8238a15a0ae8541c47a5178f3234eb654cc6afe58eaf02600ad4d47)
package.json declares a preinstall lifecycle script that runs `wget` at npm install time, sending the installer's username ($(whoami)), current working directory ($(pwd)), and hostname ($(hostname)) as URL query parameters to a hardcoded webhook.site collector (https://webhook.site/c4919b2f-dd76-4a2f-adca-2f052bc8ff0e/). This fires unconditionally on `npm install` without user consent and delivers installer identity/environment data to a third-party collector controlled by whoever created the webhook. The package name pattern and beacon shape are consistent with a dependency-confusion proof-of-concept, but the exfiltration behavior is real regardless of intent.

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.