registry / @configdirector/react-native-sdk / 1.8.0
@configdirector/react-native-sdk@1.8.0
React Native client SDK for ConfigDirector. ConfigDirector is a remote configuration and feature flag service.
AI Security Review
scanned 14d ago · by lpm-firewall-aiInspected source shows a build-only prepare hook, a hashing dependency, and client telemetry sent through the ConfigDirector API. No concrete attack behavior was found.
Static reason
No blocking static signals were detected.
Trigger
A consumer creates and uses the ConfigDirector client, which starts telemetry collection when context is updated.
Impact
The observed network behavior supports the SDK’s configuration and telemetry functions; no unrelated recipient or harmful action was established.
Mechanism
The client constructs event reports and posts them to its configured telemetry URL; the connection plan uses the ConfigDirector API host and a caller-provided SDK key.
AI rationale
Inspected source shows a build-only prepare hook, a hashing dependency, and client telemetry sent through the ConfigDirector API. No concrete attack behavior was found.
Evidence
package.jsondist/installedTestClient-CKjaEilj.mjsdist/configdirector-react-native.mjs
Network endpoints1
client-sdk-api.configdirector.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines a prepare hook that runs the build and declares @noble/hashes as its only runtime dependency.
- The inspected @noble/hashes manifest identifies a hashing library, and its sha2.js source imports hashing implementation modules.
- The runtime client uses the ConfigDirector API host and requires a caller-provided SDK key.
- Telemetry requests send event reports containing the SDK key, app metadata, and collected events to the configured telemetry URL.
Evidence against
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedpackage.jsonView file
58"prepare": "yarn build",
"typecheck": "tsc",
"lint": "eslint \"**/*.{js,ts,tsx}\"",
"test": "jest --watchAll",
"ci:test": "jest --ci",
"coverage": "jest --ci --
Low
Suspicious Dependency Evidence
package.json defines a prepare hook that runs the build and declares @noble/hashes as its only runtime dependency.
package.jsonView on unpkg · L58.lpm-dependency-evidence-1d73c8c9-ac07-4bc1-b34d-17c05e8e8544/0/npm-linux/package.jsonView file
2"name": "@noble/hashes",
"version": "2.4.0",
"description": "Audited & minimal 0-dependency JS implementation of SHA, RIPEMD, BLAKE, HMAC, HKDF, PBKDF & Scrypt",
"files": [
Low
Ai Review Evidence
The inspected @noble/hashes manifest identifies a hashing library, and its sha2.js source imports hashing implementation modules.
.lpm-dependency-evidence-1d73c8c9-ac07-4bc1-b34d-17c05e8e8544/0/npm-linux/package.jsonView on unpkg · L2Findings
1 Medium11 Low
MediumNetwork
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Dependency Evidencepackage.json
LowAi Review Evidence.lpm-dependency-evidence-1d73c8c9-ac07-4bc1-b34d-17c05e8e8544/0/npm-linux/package.json
LowAi Review Evidence.lpm-dependency-evidence-1d73c8c9-ac07-4bc1-b34d-17c05e8e8544/0/npm-linux/sha2.js
LowAi Review Evidencedist/installedTestClient-CKjaEilj.mjs
LowAi Review Evidencedist/installedTestClient-CKjaEilj.mjs
LowAi Review Evidencedist/configdirector-react-native.mjs
LowAi Review Evidencedist/configdirector-react-native.mjs
Affected versions and remediation
This report applies to @configdirector/react-native-sdk@1.8.0.
See all versions of @configdirector/react-native-sdk for other recorded verdicts.
- Review the evidence and your use of @configdirector/react-native-sdk@1.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.