registry / @dev_vlens/react-native-vlens / 1.1.0
@dev_vlens/react-native-vlens@1.1.0
⚠ Under reviewvlens
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe inspected lifecycle and API paths show package-aligned build fixes and identity verification, with no confirmed unrelated data recipient. The bundled binary archive could not be reviewed as source, so its contents remain unresolved and require manual review.
Static reason
No blocking static signals were detected.
Trigger
Installing the package runs its postinstall script; mounting the SDK starts its verification flow and logs props.
Impact
No attacker-directed impact was confirmed. Console output may expose credentials to accessible device logs, and the unresolved archive prevents a clean determination.
Mechanism
The installer conditionally edits expected Gradle text in named dependencies. Runtime API calls use the configured verification host, while authentication and component props are also printed to the console.
AI rationale
The inspected lifecycle and API paths show package-aligned build fixes and identity verification, with no confirmed unrelated data recipient. The bundled binary archive could not be reviewed as source, so its contents remain unresolved and require manual review.
Evidence
lib/module/assets/sounds.zippackage.jsonscripts/fix-android-build.jslib/module/appConfig.jslib/module/apis/api.jslib/module/apis/front.jslib/module/apis/auth.jslib/module/index.js
Network endpoints1
api.vlenseg.com
Decision evidence
public snapshotAI called this Manual Review at 72.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The postinstall hook runs a script that applies targeted Android build-file patches.
- Identity images are sent to the configured verification API with the configured authentication headers.
- The token-refresh flow logs refresh and access tokens to the console; the entrypoint also logs all component props.
- The bundled sound archive could not be assessed as UTF-8 source, leaving its contents unresolved.
Evidence against
- The inspected verification and refresh requests use the configured identity API; no unrelated recipient was established in those paths.
- The patch script writes a change only after checking expected file content and targets named Android build files.
Behavioral surface
FilesystemNetwork
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/fix-android-build.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/module/assets/sounds.zipView file
•path = lib/module/assets/sounds.zip
kind = high_entropy_blob
sizeBytes = 395795
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
lib/module/assets/sounds.zipView on unpkg•path = lib/module/assets/sounds.zip
kind = compressed_blob
sizeBytes = 395795
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
lib/module/assets/sounds.zipFindings
2 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy Bloblib/module/assets/sounds.zip
MediumNetwork
MediumShips Compressed Bloblib/module/assets/sounds.zip
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectionlib/module/assets/sounds.zip
Affected versions and remediation
This report applies to @dev_vlens/react-native-vlens@1.1.0.
See all versions of @dev_vlens/react-native-vlens for other recorded verdicts.
- Review the evidence and your use of @dev_vlens/react-native-vlens@1.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.