MAL-2026-12424

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (615dd38493e2ff2257cfe5fe94b089a9001329b0d68c6b48f7ac491e4fcb205f) react-native-ui-message@1.0.0 declares a postinstall hook that runs src/utilities/SubscriptionGuard.js. On install the script enumerates non-internal network interfaces via os.networkInterfaces() to obtain the host's MAC address, then POSTs {mac, os: process.platform, path: __dirname} to https://react-native-ui-message.com/api/EntitlementState. It then issues a GET to https://react-native-ui-message.com/api/ValidateLicense/... and passes the response body to Node's vm.runInContext with a context exposing require/process/Buffer, executing arbitrary server-returned JavaScript on the installer's machine. The accompanying integrity check compares a constant string against itself, so no verification of the fetched code occurs. The package presents itself as a pure-JS React Native toast/message component, for which no license-server-controlled remote code path is required.