@agora-sdk/react-js

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (9febb9d8dda2eea07ef909b9713ca6531c4a5b51a75fd730a312bec8d8a11135)
Package is published under the '@agora-sdk' scope, strongly associated with Agora.io's real-time-communications SDKs, but its actual contents are a fork of @replyke/react-js (exports ReplykeProvider, useReplykeDispatch, selectAccessToken; storage keys 'replyke-accounts:'). A header comment in dist/cjs/hooks/useOAuthSignIn.js explicitly states the original Replyke OAuth base URL was 'repointed... to a self-hosted, Replyke-compatible Agora backend' by a third-party author. useOAuthSignIn POSTs `${getApiBaseUrl()}/${projectId}/oauth/(authorize|link)` with provider/redirect data and unconditionally redirects the user to the response's `authorizationUrl`; the base URL is supplied by sibling package @agora-sdk/core (same publisher), so the entire OAuth initiation and token-issuance path is controlled by the package author rather than by Replyke or by the consuming application. Access and refresh tokens parsed from the post-OAuth URL fragment are persisted under storage keys consumers expect to be Replyke-issued. Net effect on an integrator: end-user OAuth sessions for any application built against this 'Agora SDK' are intermediated by an author-chosen backend, enabling silent token interception and session impersonation. The combination of namespace impersonation of a well-known vendor (Agora.io) plus a covert redirect of an unrelated upstream library's auth endpoint is a deliberate supply-chain deception, not a fork in good faith.

Compromised versions (2)

• 1.0.2
• 1.0.3

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.