registry / @dev_vlens/react-native-vlens / 1.0.4
@dev_vlens/react-native-vlens@1.0.4
vlens
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe automatic installer is a bounded compatibility patcher, not an opaque execution chain, and the runtime networking matches the SDK's identity-verification function. No concrete malicious behavior was found by static source inspection.
Static reason
No blocking static signals were detected.
Trigger
Installing the package runs the Gradle patcher; rendering the VLens component and capturing identity data triggers verification requests.
Impact
It can alter exact known dependency build files during installation and transmit user-provided verification data to the configured service.
Mechanism
Narrow Android dependency patching and configured biometric API requests.
AI rationale
The automatic installer is a bounded compatibility patcher, not an opaque execution chain, and the runtime networking matches the SDK's identity-verification function. No concrete malicious behavior was found by static source inspection.
Network endpoints1
api.vlenseg.com
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Its postinstall hook runs a script that can modify exact matching Android Gradle files in installed dependencies.
- At runtime it sends supplied ID, face, and NFC data to the configured identity-verification API.
- The flagged archive is an audio bundle, and the flagged localization file contains ordinary UI strings.
Evidence against
- The installer is transparent, makes narrowly matched build-compatibility replacements, and has no shell, network, payload-download, or self-dependency behavior.
- Network calls are product-aligned identity-verification requests to the configured service.
- No credential harvesting, hidden persistence, dynamic code execution, or AI-agent control-surface writes were found.
Behavioral surface
FilesystemNetwork
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/fix-android-build.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/module/assets/sounds.zipView file
•path = lib/module/assets/sounds.zip
kind = high_entropy_blob
sizeBytes = 395795
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
lib/module/assets/sounds.zipView on unpkg•path = lib/module/assets/sounds.zip
kind = compressed_blob
sizeBytes = 395795
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
lib/module/assets/sounds.zipFindings
3 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy Bloblib/module/assets/sounds.zip
HighSemantic Analysis Limitedlib/commonjs/localization/strings/en.json
MediumNetwork
MediumShips Compressed Bloblib/module/assets/sounds.zip
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectionlib/module/assets/sounds.zip
Affected versions and remediation
This report applies to @dev_vlens/react-native-vlens@1.0.4.
See all versions of @dev_vlens/react-native-vlens for other recorded verdicts.
- Review the evidence and your use of @dev_vlens/react-native-vlens@1.0.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.