Encyclopedia
npm☠ CRITICALphantom⚠ ACTIVE THREAT

react-native-reanimated-carplay

First seen: Feb 18, 2025 0 viewsMimics: react-native-reanimated
Share threatHN
Threat Description

A phantom package that does not exist in any legitimate form, yet is consistently suggested by AI coding assistants when developers ask for CarPlay integration with react-native-reanimated. The registered version drops an obfuscated reverse-shell payload that activates on a delay, making attribution difficult.

AI Hallucination Analysis
Very Likely AI Hallucination96%
Known to be hallucinated by: GitHub Copilot, Cursor, ChatGPT-4
Remediation Guide
  1. Remove 'react-native-reanimated-carplay' from your dependencies immediately.
  2. There is no legitimate equivalent — implement CarPlay via native modules.
  3. Audit your codebase for any imports of the malicious package.
  4. Run a full security audit for persistent backdoors.
  5. Rotate all credentials that may have been exposed.
Quick Facts
Ecosystem
npm
Risk Level
CRITICAL
Type
phantom
Status
ACTIVE
Legitimate Package
react-native-reanimated
Hallucination Confidence
96%
Check My Project
Scan for this package