@configdirector/react-native-sdk@1.10.1
React Native client SDK for ConfigDirector. ConfigDirector is a remote configuration and feature flag service.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe runtime telemetry is enabled by default and can transmit context and configuration values, while the inspected README and API surface do not disclose it or show a way to disable it. The destination is the SDK vendor's own service, so this warrants a warning rather than a malicious verdict.
Static reason
No blocking static signals were detected.
Trigger
The app mounts ConfigDirectorProvider and its client starts or evaluates configuration.
Impact
App context and configuration values may be disclosed to the vendor without clear disclosure or an evident opt-out in the inspected package.
Mechanism
The enabled telemetry collector batches event data and POSTs it to the client telemetry endpoint.
AI rationale
The runtime telemetry is enabled by default and can transmit context and configuration values, while the inspected README and API surface do not disclose it or show a way to disable it. The destination is the SDK vendor's own service, so this warrants a warning rather than a malicious verdict.
Evidence
dist/configdirector-react-native.mjsdist/installedTestClient-CM98r0qu.mjs
Network endpoints1
client-sdk-api.configdirector.com
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The telemetry collector is enabled by default and schedules a flush after it starts.
- Telemetry reports include the SDK key, install instance ID, app name and version, context, and event data.
- Evaluated-config events include the default and evaluated values.
- The reporter POSTs the event report to the client telemetry endpoint.
- The endpoint is the vendor's client SDK API, and telemetry starts during normal client use.
Evidence against
- The package describes itself as a remote configuration and feature-flag SDK, for which reporting evaluations to its service is relevant.
- The observed network destination is the package vendor's API; no unrelated collector or machine credential scraping was identified.
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/configdirector-react-native.mjsView file
221vents", true);
_defineProperty(this, "initialFlushIntervalDelay", void 0);
_defineProperty(this, "started", false);
this.logger = options.logger;
this.evaluationEventQueue = new EventQueue((_options$evaluationQu = options.evaluationQueueLimit) !== null && _options$evaluationQu !== void 0 ? _options$evaluationQu
Medium
Ai Review Evidence
The telemetry collector is enabled by default and schedules a flush after it starts.
dist/configdirector-react-native.mjsView on unpkg · L22184y: this.sdkKey,
instanceId,
metaContext: {
sdkName: this.sdkIdentity.sdkName,
sdkVersion: this.sdkIdentity.sdkVersion,
appName: this.metaContext.appName,
appVersion: this.metaContext.appVersion
},
context,
discreteEvents,
aggregatedEvents,
droppedEvents
};
if
Medium
Ai Review Evidence
Telemetry reports include the SDK key, install instance ID, app name and version, context, and event data.
dist/configdirector-react-native.mjsView on unpkg · L84744value: event.defaultValue,
type: event.type
}),
evaluatedValue: mapToTelemetryValue({
value: event.evaluatedValue,
valueId: event.evaluatedValueId,
type: event.type
})
};
}
};
//#endregion
//#region src/sha256H
Findings
7 Medium4 Low
MediumNetwork
MediumAi Review Evidencedist/configdirector-react-native.mjs
MediumAi Review Evidencedist/configdirector-react-native.mjs
MediumAi Review Evidencedist/configdirector-react-native.mjs
MediumAi Review Evidencedist/configdirector-react-native.mjs
MediumAi Review Evidencedist/installedTestClient-CM98r0qu.mjs
MediumAi Review Evidencedist/configdirector-react-native.mjs
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @configdirector/react-native-sdk@1.10.1.
See all versions of @configdirector/react-native-sdk for other recorded verdicts.
- Review the evidence and your use of @configdirector/react-native-sdk@1.10.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.