registry / @blario/react-native / 0.1.0
@blario/react-native@0.1.0
Blar agent SDK for React Native
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe flagged bundle is embedded as a messages-only widget with agent execution disabled, and its API requests use the configured service endpoint. The fixed Sentry reporting path is bounded error telemetry; no concrete malicious behavior was established.
Static reason
No blocking static signals were detected.
Trigger
The provider starts when mounted unless explicitly disabled; the widget is used when chat is enabled.
Impact
Source inspection did not establish account hijacking, credential theft, or another unrelated attack.
Mechanism
The widget sends requests to the configured API and passes app-supplied identity. Error events go to the fixed Sentry destination.
AI rationale
The flagged bundle is embedded as a messages-only widget with agent execution disabled, and its API requests use the configured service endpoint. The fixed Sentry reporting path is bounded error telemetry; no concrete malicious behavior was established.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to src/index.ts and declares no preinstall, install, or postinstall hook.
- The provider starts the SDK unless explicitly disabled, then subscribes to app, agent, and chat state.
- The embedded widget uses the configured API base URL and app-supplied identity; its configuration limits it to messages and disables agent execution.
- Error reporting sends bounded exception telemetry to a fixed Sentry destination. The event can include source, session, and user identifiers.
- The remaining required paths contain backend helpers, native interaction code, and UI or layout modules; inspection found no independent account-changing or credential-forwarding attack.
Evidence against
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
8 flaggedsrc/chat/widget-bundle.generated.tsView file
1export const WIDGET_BUNDLE_DIGEST: string | null = "9b6baa61f564";
L2: export const WIDGET_BUNDLE: string | null = "\n!function(){try{var e=\"undefined\"!=typeof window?window:\"undefined\"!=typeof global?global:\"undefined\"!=typeof globalThis?global...
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
src/chat/widget-bundle.generated.tsView on unpkg · L1package.jsonView file
14"main": "src/index.ts",
"types": "dist/index.d.ts",
"react-native": "src/index.ts",
"files": [
"src",
"dist"
],
"scripts": {
"build": "tsc -p tsconfig.
Low
Suspicious Lifecycle Evidence
The manifest points to src/index.ts and declares no preinstall, install, or postinstall hook.
package.jsonView on unpkg · L1421
Findings
1 High1 Medium10 Low
HighBrowser Session Account Hijacksrc/chat/widget-bundle.generated.ts
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/BlarProvider.tsx
LowAi Review Evidencesrc/backend/session-change.ts
LowAi Review Evidencesrc/BlarProvider.tsx
LowAi Review Evidencesrc/BlarProvider.tsx
LowAi Review Evidencesrc/BlarProvider.tsx
Affected versions and remediation
This report applies to @blario/react-native@0.1.0.
See all versions of @blario/react-native for other recorded verdicts.
- Review the evidence and your use of @blario/react-native@0.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.