registry / @configdirector/react-native-sdk / 1.9.0
@configdirector/react-native-sdk@1.9.0
React Native client SDK for ConfigDirector. ConfigDirector is a remote configuration and feature flag service.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe manifest's prepare hook builds the package, and the inspected runtime network activity supports the SDK's configuration and telemetry functions. The required hash dependency contains hashing and input-validation code, with no install hook identified.
Static reason
No blocking static signals were detected.
Trigger
A consumer initializes and uses the SDK client or provider.
Impact
No confirmed harmful effect was found in the inspected source.
Mechanism
The client posts its configured context and telemetry to the ConfigDirector client API.
AI rationale
The manifest's prepare hook builds the package, and the inspected runtime network activity supports the SDK's configuration and telemetry functions. The required hash dependency contains hashing and input-validation code, with no install hook identified.
Network endpoints1
client-sdk-api.configdirector.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package entrypoint is the React Native SDK distribution; its prepare hook runs the build.
- The inspected dependency manifest contains no install lifecycle hook; its scripts are for hashing-library development and tests.
- The required hash dependency implements SHA-2 using local hash helpers.
- The required utility dependency validates byte-array inputs.
- The SDK sends configured context and evaluation telemetry to its client API endpoint during normal client use.
Evidence against
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedpackage.jsonView file
26"main": "./dist/configdirector-react-native.mjs",
"types": "./dist/configdirector-react-native.d.mts",
"exports": {
".": {
"source": "./src/index.tsx",
"react-native": "./dist/configdirector-react-native.mjs",
"types": "./dist/configdirector-react-native.d.mts",
"default": "./dist/configdirector-react-native.mjs"
},
"./testing": {
"source": "./src/testing.ts",
"react-native": "./dist/configdirector-react-native-testing.mjs",
"
Low
Ai Review Evidence
The package entrypoint is the React Native SDK distribution; its prepare hook runs the build.
package.jsonView on unpkg · L2653"scripts": {
"example": "yarn workspace @configdirector/react-native-sdk-example",
"clean": "rm -fr dist",
"build": "tsdown",
"verify:dist": "node ../../scripts/verify-dist-version.mjs",
"prepare": "yarn build",
"typecheck": "tsc",
"lint": "eslint \"**/*.{js,ts,tsx}\"",
"test": "jest --watchAll",
"ci:test": "jest --ci",
"coverage": "jest --ci --coverage",
"release": "yarn clean && yarn lint && yarn ci:test && yarn build && yarn verify:dist && npm publish --access public"
},
"publishConfig": {
"registr
Low
Ai Review Evidence
The package entrypoint is the React Native SDK distribution; its prepare hook runs the build.
package.jsonView on unpkg · L53Findings
1 Medium11 Low
MediumNetwork
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencepackage.json
LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-e256e5e5-a17d-4938-9ce2-c86c0e2719da/0/npm-linux/package.json
LowSuspicious Dependency Evidence.lpm-dependency-evidence-e256e5e5-a17d-4938-9ce2-c86c0e2719da/0/npm-linux/sha2.js
LowSuspicious Dependency Evidence.lpm-dependency-evidence-e256e5e5-a17d-4938-9ce2-c86c0e2719da/0/npm-linux/utils.js
LowAi Review Evidencedist/configdirector-react-native.mjs
LowAi Review Evidencedist/configdirector-react-native.mjs
Affected versions and remediation
This report applies to @configdirector/react-native-sdk@1.9.0.
See all versions of @configdirector/react-native-sdk for other recorded verdicts.
- Review the evidence and your use of @configdirector/react-native-sdk@1.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.