🛡️ MAL-2026-4359 — react-js

Malicious code in @agora-sdk/react-js (npm)

Source: amazon-inspector

Package is published under the '@agora-sdk' scope, strongly associated with Agora.io's real-time-communications SDKs, but its actual contents are a fork of @replyke/react-js (exports ReplykeProvider, useReplykeDispatch, selectAccessToken; storage keys 'replyke-accounts:'). A header comment in dist/cjs/hooks/useOAuthSignIn.js explicitly states the original Replyke OAuth base URL was 'repointed... to a self-hosted, Replyke-compatible Agora backend' by a third-party author. useOAuthSignIn POSTs ${getApiBaseUrl()}/${projectId}/oauth/(authorize|link) with provider/redirect data and unconditionally redirects the user to the response's authorizationUrl; the base URL is supplied by sibling package @agora-sdk/core (same publisher), so the entire OAuth initiation and token-issuance path is controlled by the package author rather than by Replyke or by the consuming application. Access and refresh tokens parsed from the post-OAuth URL fragment are persisted under storage keys consumers expect to be Replyke-issued. Net effect on an integrator: end-user OAuth sessions for any application built against this 'Agora SDK' are intermediated by an author-chosen backend, enabling silent token interception and session impersonation. The combination of namespace impersonation of a well-known vendor (Agora.io) plus a covert redirect of an unrelated upstream library's auth endpoint is a deliberate supply-chain deception, not a fork in good faith.