@dev_vlens/react-native-vlens@1.0.5
vlens
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not proven malware, but automatic mutation of foreign dependencies plus logging of biometric identity data is a concrete unsafe capability. The source supports a warning rather than a publish block.
Static reason
No blocking static signals were detected.
Trigger
npm installation runs postinstall; using front-ID verification sends and logs a captured image.
Impact
Consumer dependency contents can be changed without a user command, and identity images may be exposed through device or collected logs.
Mechanism
Automatic dependency patching and sensitive request logging.
AI rationale
This is not proven malware, but automatic mutation of foreign dependencies plus logging of biometric identity data is a concrete unsafe capability. The source supports a warning rather than a publish block.
Evidence
package.jsonscripts/fix-android-build.jssrc/apis/front.tsxsrc/services/DatadogService.tsnode_modules/expo-modules-core/android/ExpoModulesCorePlugin.gradlenode_modules/react-native-screens/android/build.gradlenode_modules/expo-modules-core/android/build.gradlenode_modules/react-native-worklets-core/android/build.gradle
Network endpoints1
api.vlenseg.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package automatically runs a postinstall script.
- That script locates and overwrites files in other installed packages' Android build configurations.
- The runtime logs a full base64 identity-image request body before sending it.
- Datadog logging is enabled with granted tracking consent and bundled logs.
Evidence against
- The install script uses fixed text replacements for named Android build compatibility patches; no shell, network, or payload download is present.
- The identity API host is explicitly configured and image upload matches the SDK's stated verification function.
- The bundled archive inventories as audio files rather than executable content.
Behavioral surface
FilesystemNetwork
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/fix-android-build.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/module/assets/sounds.zipView file
•path = lib/module/assets/sounds.zip
kind = high_entropy_blob
sizeBytes = 395795
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
lib/module/assets/sounds.zipView on unpkg•path = lib/module/assets/sounds.zip
kind = compressed_blob
sizeBytes = 395795
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
lib/module/assets/sounds.zipFindings
3 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy Bloblib/module/assets/sounds.zip
HighSemantic Analysis Limitedlib/commonjs/localization/strings/en.json
MediumNetwork
MediumShips Compressed Bloblib/module/assets/sounds.zip
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectionlib/module/assets/sounds.zip
Affected versions and remediation
This report applies to @dev_vlens/react-native-vlens@1.0.5.
See all versions of @dev_vlens/react-native-vlens for other recorded verdicts.
- Review the evidence and your use of @dev_vlens/react-native-vlens@1.0.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.