@configdirector/react-native-sdk
React Native client SDK for ConfigDirector. ConfigDirector is a remote configuration and feature flag service.
This report shows the evidence for @configdirector/react-native-sdk@1.10.1. 0 of 14 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe runtime telemetry is enabled by default and can transmit context and configuration values, while the inspected README and API surface do not disclose it or show a way to disable it. The destination is the SDK vendor's own service, so this warrants a warning rather than a malicious verdict.
Decision evidence
public snapshot- The telemetry collector is enabled by default and schedules a flush after it starts.
- Telemetry reports include the SDK key, install instance ID, app name and version, context, and event data.
- Evaluated-config events include the default and evaluated values.
- The reporter POSTs the event report to the client telemetry endpoint.
- The endpoint is the vendor's client SDK API, and telemetry starts during normal client use.
- The package describes itself as a remote configuration and feature-flag SDK, for which reporting evaluations to its service is relevant.
- The observed network destination is the package vendor's API; no unrelated collector or machine credential scraping was identified.
Source & flagged code
6 flaggedThe telemetry collector is enabled by default and schedules a flush after it starts.
dist/configdirector-react-native.mjsView on unpkg · L221Telemetry reports include the SDK key, install instance ID, app name and version, context, and event data.
dist/configdirector-react-native.mjsView on unpkg · L84Findings
Affected versions and remediation
This report applies to @configdirector/react-native-sdk@1.10.1.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @configdirector/react-native-sdk@1.10.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.