MAL-2025-6727

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hyperion-react-native-testapp/MAL-2025-6727.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-6727
Published
2025-07-28T18:03:36Z
Modified
2026-08-26T01:10:18Z
Summary
Malicious code in hyperion-react-native-testapp (npm)
Details

The package communicates with a domain associated with malicious activity.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (09dade0de8238a15a0ae8541c47a5178f3234eb654cc6afe58eaf02600ad4d47)

package.json declares a preinstall lifecycle script that runs wget at npm install time, sending the installer's username ($(whoami)), current working directory ($(pwd)), and hostname ($(hostname)) as URL query parameters to a hardcoded webhook.site collector (https://webhook.site/c4919b2f-dd76-4a2f-adca-2f052bc8ff0e/). This fires unconditionally on npm install without user consent and delivers installer identity/environment data to a third-party collector controlled by whoever created the webhook. The package name pattern and beacon shape are consistent with a dependency-confusion proof-of-concept, but the exfiltration behavior is real regardless of intent.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018696",
            "import_time": "2026-08-25T08:20:36.285672531Z",
            "modified_time": "2026-08-25T07:59:17Z",
            "sha256": "09dade0de8238a15a0ae8541c47a5178f3234eb654cc6afe58eaf02600ad4d47",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / hyperion-react-native-testapp

Package

Name
hyperion-react-native-testapp
View open source insights on deps.dev
Purl
pkg:npm/hyperion-react-native-testapp

Affected ranges

Type
SEMVER
Events
Introduced
10.0.0

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "2486f7fd625a5fcab7da2c2a5a65b5b54afb420976be20dad3b3298cfd59c01a",
            "tlsh": "d80199b5a2316e7306c68ab11570422fe662f79b92162d1dbba32219a32ecb2107c515"
        }
    ],
    "package_integrity": [
        {
            "filename": "hyperion-react-native-testapp-1.0.0.tgz",
            "hashes": {
                "sha1": "6d333fefe66bde78f58f733d0eb05a16116cb782",
                "sha512_sri": "sha512-7b8FQfCIVq91QL2kFPXY4Z9DPCF/9C1mJ9tGNcSGea6rrvmDtLfhAaOH2J0U9rifLQ2Z1Rd3K2SI/y9OMtAW3w=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hyperion-react-native-testapp/MAL-2025-6727.json"