MAL-2026-4359

Dashboard / Malicious Package / MAL-2026-4359

MAL-2026-4359

Summary: Malicious code in @agora-sdk/react-js (npm)

Details: Source: amazon-inspector (9febb9d8dda2eea07ef909b9713ca6531c4a5b51a75fd730a312bec8d8a11135) Package is published under the '@agora-sdk' scope, strongly associated with Agora.io's real-time-communications SDKs, but its actual contents are a fork of @replyke/react-js (exports ReplykeProvider, useReplykeDispatch, selectAccessToken; storage keys 'replyke-accounts:'). A header comment in dist/cjs/hooks/useOAuthSignIn.js explicitly states the original Replyke OAuth base URL was 'repointed... to a self-hosted, Replyke-compatible Agora backend' by a third-party author. useOAuthSignIn POSTs `${getApiBaseUrl()}/${projectId}/oauth/(authorize|link)` with provider/redirect data and unconditionally redirects the user to the response's `authorizationUrl`; the base URL is supplied by sibling package @agora-sdk/core (same publisher), so the entire OAuth initiation and token-issuance path is controlled by the package author rather than by Replyke or by the consuming application. Access and refresh tokens parsed from the post-OAuth URL fragment are persisted under storage keys consumers expect to be Replyke-issued. Net effect on an integrator: end-user OAuth sessions for any application built against this 'Agora SDK' are intermediated by an author-chosen backend, enabling silent token interception and session impersonation. The combination of namespace impersonation of a well-known vendor (Agora.io) plus a covert redirect of an unrelated upstream library's auth endpoint is a deliberate supply-chain deception, not a fork in good faith.

References: https://www.npmjs.com/package/@agora-sdk/react-js/v/1.0.2, https://www.npmjs.com/package/@agora-sdk/react-js/v/1.0.3