@configdirector/react-native-sdk@1.10.0
React Native client SDK for ConfigDirector. ConfigDirector is a remote configuration and feature flag service.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe SDK sends runtime telemetry containing context and event data by default, while its README does not disclose that collection or describe an opt-out. The destination is the SDK’s own service and the behavior is tied to its intended client functionality, so this warrants a warning rather than a malicious verdict.
Decision evidence
public snapshot- Telemetry reports include the client SDK key, install instance ID, app metadata, submitted context, and event data.
- Event collection is enabled by default and flushes on a timer after it starts.
- The client starts telemetry after connecting with the supplied context.
- Telemetry is sent to the ConfigDirector client API, the service this SDK is designed to use.
- The package is documented as a React Native remote configuration and feature flag SDK.
- The manifest’s prepare script builds the package; no install hook that sends data was identified.
Source & flagged code
4 flaggedTelemetry reports include the client SDK key, install instance ID, app metadata, submitted context, and event data.
dist/configdirector-react-native.mjsView on unpkg · L82Event collection is enabled by default and flushes on a timer after it starts.
dist/configdirector-react-native.mjsView on unpkg · L221Findings
Affected versions and remediation
This report applies to @configdirector/react-native-sdk@1.10.0.
See all versions of @configdirector/react-native-sdk for other recorded verdicts.
- Review the evidence and your use of @configdirector/react-native-sdk@1.10.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.