MAL-2025-6727

    Dashboard / Malicious Package / MAL-2025-6727

    MAL-2025-6727

    Published: 28 Jul 2025Last Modified: 26 Aug 2026

    Summary: Malicious code in hyperion-react-native-testapp (npm)

    Details: The package communicates with a domain associated with malicious activity. Source: amazon-inspector (09dade0de8238a15a0ae8541c47a5178f3234eb654cc6afe58eaf02600ad4d47) package.json declares a preinstall lifecycle script that runs `wget` at npm install time, sending the installer's username ($(whoami)), current working directory ($(pwd)), and hostname ($(hostname)) as URL query parameters to a hardcoded webhook.site collector (https://webhook.site/c4919b2f-dd76-4a2f-adca-2f052bc8ff0e/). This fires unconditionally on `npm install` without user consent and delivers installer identity/environment data to a third-party collector controlled by whoever created the webhook. The package name pattern and beacon shape are consistent with a dependency-confusion proof-of-concept, but the exfiltration behavior is real regardless of intent.

    References: https://www.npmjs.com/package/hyperion-react-native-testapp/v/1.0.0

    Affected packages

    Package

    Name: hyperion-react-native-testapp

    Purl: pkg:npm/hyperion-react-native-testapp

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 10.0.0
    Fixed -None

    Affected versions

    1.0.0
    MAL-2025-6727 | CVE-DB