@amplytools/react-native-amply-sdk: Suspicious npm security

Loading npm security reports…

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 89.7 KB of source, external domains: maven.pkg.github.com

Source & flagged code

2 flagged

dist/plugin/index.jsView file

Lines 15-55javascript

15 }

16 return to;

17};

18var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

20// plugin/index.ts

21var plugin_exports = {};

22__export(plugin_exports, {

23 default: () => plugin_default

24});

25module.exports = __toCommonJS(plugin_exports);

27// plugin/withAmply.ts

28var import_config_plugins = require("@expo/config-plugins");

29var import_generateCode = require("@expo/config-plugins/build/utils/generateCode");

30var import_codeMod = require("@expo/config-plugins/build/android/codeMod");

31var DEFAULT_SDK_VERSION = "0.1.7";

32var GITHUB_MAVEN_URL = "https://maven.pkg.github.com/amply/sdk";

33var GITHUB_MAVEN_CREDENTIALS_ENV = {

34 username: "AMPLY_MAVEN_USERNAME",

35 password: "AMPLY_MAVEN_PASSWORD"

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/plugin/index.jsView on unpkg · L35

36};

37var GITHUB_GRADLE_REPOSITORY_SNIPPET = `

38 maven {

39 url '${GITHUB_MAVEN_URL}'

40 credentials {

41 username findProperty('${GITHUB_MAVEN_CREDENTIALS_ENV.username}') ?: System.getenv('${GITHUB_MAVEN_CREDENTIALS_ENV.username}')

42 password findProperty('${GITHUB_MAVEN_CREDENTIALS_ENV.password}') ?: System.getenv('${GITHUB_MAVEN_CREDENTIALS_ENV.password}')

43 }

44 }

45`;

46var GRADLE_DEPENDENCY_LINE = ` implementation("tools.amply:sdk-android:${"$"}{project.findProperty('amplySdkVersion') ?: System.getenv('AMPLY_SDK_VERSION') ?: '${DEFAULT_SDK_VERSION}'}")`;

47function applyGithubMavenRepository(contents) {

48 if (contents.includes(GITHUB_MAVEN_URL)) {

49 return contents;

50 }

51 const repositoriesBlock = /(repositories\s*\{[\s\S]*?\n\})/;

52 if (repositoriesBlock.test(contents)) {

53 return contents.replace(repositoriesBlock, (match) => {

54 if (match.includes(GITHUB_MAVEN_URL)) {

55 return match;

dist/plugin/index.mjsView file

Lines 1-35javascript

1// plugin/withAmply.ts

2import {

3 withGradleProperties,

4 withProjectBuildGradle,

5 withMainApplication,

6 withSettingsGradle,

7 withAppBuildGradle

8} from "@expo/config-plugins";

9import { mergeContents }

Source & flagged code

2 flagged · loading source

dist/plugin/index.jsView file

35patternName = generic_password severity = medium line = 35 matchedText = password...ORD"

Medium

@amplytools/react-native-amply-sdk: Suspicious npm security | LPM Firewall

Source & flagged code

2 flagged

dist/plugin/index.jsView file

Lines 15-55javascript

15 }

16 return to;

17};

18var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

20// plugin/index.ts

21var plugin_exports = {};

22__export(plugin_exports, {

23 default: () => plugin_default

24});

25module.exports = __toCommonJS(plugin_exports);

27// plugin/withAmply.ts

28var import_config_plugins = require("@expo/config-plugins");

29var import_generateCode = require("@expo/config-plugins/build/utils/generateCode");

30var import_codeMod = require("@expo/config-plugins/build/android/codeMod");

31var DEFAULT_SDK_VERSION = "0.1.7";

32var GITHUB_MAVEN_URL = "https://maven.pkg.github.com/amply/sdk";

33var GITHUB_MAVEN_CREDENTIALS_ENV = {

34 username: "AMPLY_MAVEN_USERNAME",

35 password: "AMPLY_MAVEN_PASSWORD"

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/plugin/index.jsView on unpkg · L35

36};

37var GITHUB_GRADLE_REPOSITORY_SNIPPET = `

38 maven {

39 url '${GITHUB_MAVEN_URL}'

40 credentials {

41 username findProperty('${GITHUB_MAVEN_CREDENTIALS_ENV.username}') ?: System.getenv('${GITHUB_MAVEN_CREDENTIALS_ENV.username}')

42 password findProperty('${GITHUB_MAVEN_CREDENTIALS_ENV.password}') ?: System.getenv('${GITHUB_MAVEN_CREDENTIALS_ENV.password}')

43 }

44 }

45`;

46var GRADLE_DEPENDENCY_LINE = ` implementation("tools.amply:sdk-android:${"$"}{project.findProperty('amplySdkVersion') ?: System.getenv('AMPLY_SDK_VERSION') ?: '${DEFAULT_SDK_VERSION}'}")`;

47function applyGithubMavenRepository(contents) {

48 if (contents.includes(GITHUB_MAVEN_URL)) {

49 return contents;

50 }

51 const repositoriesBlock = /(repositories\s*\{[\s\S]*?\n\})/;

52 if (repositoriesBlock.test(contents)) {

53 return contents.replace(repositoriesBlock, (match) => {

54 if (match.includes(GITHUB_MAVEN_URL)) {

55 return match;

dist/plugin/index.mjsView file

Lines 1-35javascript

1// plugin/withAmply.ts

2import {

3 withGradleProperties,

4 withProjectBuildGradle,

5 withMainApplication,

6 withSettingsGradle,

7 withAppBuildGradle

8} from "@expo/config-plugins";

9import { mergeContents }

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code