registry / @blario/react-native
@blario/react-native
Blar agent SDK for React Native
This report shows the evidence for @blario/react-native@0.1.4. 0 of 5 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2h ago · by lpm-firewall-aiThe flagged bundle contains an authenticated API bridge, but calls require session-provided configuration and allowed hosts, with confirmation controls for API actions. Runtime error reporting is disclosed as limited to SDK-contained failures, and the widget disables default PII collection.
Static reason
No blocking static signals were detected.
Trigger
The provider starts when mounted with a configured connection; the embedded chat widget runs when used.
Impact
No unauthorized account changes, credential exfiltration, or unrelated data collection were identified.
Mechanism
The native WebView bridge serves metadata and identity proof. The widget API bridge requires a session descriptor, restricts allowed hosts, and presents API confirmation controls.
AI rationale
The flagged bundle contains an authenticated API bridge, but calls require session-provided configuration and allowed hosts, with confirmation controls for API actions. Runtime error reporting is disclosed as limited to SDK-contained failures, and the widget disables default PII collection.
Network endpoints1
o4507510402383872.ingest.us.sentry.io/4511661901414400
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package entry point exports the SDK provider and API; package metadata describes it as a React Native agent SDK.
- The provider starts when mounted only if enabled, and disables itself without valid connection configuration.
- The WebView bridge exposes only metadata and identity-proof calls to the page.
- The widget API bridge rejects calls without a configured descriptor and rejects hosts outside its allowlist.
- API confirmation messages render decision buttons; the bridge accepts only configured HTTP methods and requires a permission question.
- The README discloses SDK error reporting to Blar's Sentry, and the widget config disables default PII collection.
Evidence against
- The embedded widget can resolve authentication and send requests through an API bridge, but its descriptor and allowed hosts are session-configured.
- The widget contains a Sentry endpoint for runtime error reporting; the README describes this reporting as limited to SDK-contained failures.
Behavioral surface
NetworkWebSocket
Source & flagged code
8 flaggedsrc/chat/widget-bundle.generated.tsView file
1export const WIDGET_BUNDLE_DIGEST: string | null = "a829faeab2a4";
L2: export const WIDGET_BUNDLE: string | null = "\n!function(){try{var e=\"undefined\"!=typeof window?window:\"undefined\"!=typeof global?global:\"undefined\"!=typeof globalThis?global...
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
src/chat/widget-bundle.generated.tsView on unpkg · L12idge descriptor configured for this session\"}},!1,t);const i=this.resolveBaseUrl(n,e);if(null===i)return this.toResult(e.api_call_id,{status:0,responseBody:null,error:{code:\"invalid_base_url\",message:`${e.base_url} is not an allowed API host`}},!1,t);const r=await this.resolveAuth(n,i);if(r.error)return this.toResult(e.api_call_id,{status:0,responseBody:n
Low
Ai Review Evidence
The widget API bridge rejects calls without a configured descriptor and rejects hosts outside its allowlist.
src/chat/widget-bundle.generated.tsView on unpkg · L22DELETE\"===t)}isValidPermissionRequest(e){return\"string\"==typeof e.permission_id&&0!==e.permission_id.length&&\"string\"==typeof e.user_permission_question}sendSystemResponse(e){if(!this.websocket||!this.isConnected||this.websocket.readyState!==WebSocket.OPEN)return;const t=JSON.stringify(e);this.emitFrame(t)}sendSDKResponse(e){this.sendOrCacheForFlush(e.command_id,e)}sendSDKError(e,t,n){this.sendOrCacheForFlush(e,{type:\"sdk_error\",command_id:e,error:t,...n&&{code:n}})}se
Findings
1 High1 Medium10 Low
HighBrowser Session Account Hijacksrc/chat/widget-bundle.generated.ts
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencesrc/index.ts
LowAi Review Evidencesrc/BlarProvider.tsx
LowAi Review Evidencesrc/chat/bridge.ts
LowAi Review Evidencesrc/chat/ChatView.tsx
LowAi Review Evidencesrc/chat/widget-bundle.generated.ts
LowAi Review Evidencesrc/chat/widget-bundle.generated.ts
Affected versions and remediation
This report applies to @blario/react-native@0.1.4.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @blario/react-native@0.1.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.