@dev_vlens/react-native-vlens@1.1.1
vlens
AI Security Review
scanned 10h ago · by lpm-firewall-aiThe view starts runtime Datadog telemetry automatically with granted consent and full RUM sampling, and the inspected package source provides no disclosure or opt-out. This is suspicious telemetry; the install hook itself appears limited to targeted Android build patches.
Static reason
No blocking static signals were detected.
Trigger
The application mounts the exported VLens view.
Impact
Runtime usage and diagnostic data may be sent to the package publisher’s Datadog account without disclosure or an opt-out shown in the inspected source.
Mechanism
The view initializes Datadog with tracking consent set to GRANTED, enables logs and RUM, and configures 100% RUM sampling.
AI rationale
The view starts runtime Datadog telemetry automatically with granted consent and full RUM sampling, and the inspected package source provides no disclosure or opt-out. This is suspicious telemetry; the install hook itself appears limited to targeted Android build patches.
Evidence
lib/module/index.jslib/commonjs/services/DatadogService.js
Network endpoints2
Datadog US5 site (hostname not specified in package source)api.vlenseg.com
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Mounting the SDK view automatically initializes Datadog and adds a tenancy attribute.
- Datadog is configured with tracking consent granted, logs bundled with RUM, and 100% RUM session and resource sampling.
- The postinstall script reads and conditionally patches named Android Gradle files in related dependencies.
Evidence against
- The package’s API defaults to its own service at api.vlenseg.com and accepts service credentials through its configuration.
- The postinstall patcher applies specific Android build compatibility changes and does not contact a network host.
Behavioral surface
FilesystemNetwork
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/fix-android-build.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/module/assets/sounds.zipView file
•path = lib/module/assets/sounds.zip
kind = high_entropy_blob
sizeBytes = 395795
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
lib/module/assets/sounds.zipView on unpkg•path = lib/module/assets/sounds.zip
kind = compressed_blob
sizeBytes = 395795
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
lib/module/assets/sounds.zipFindings
2 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy Bloblib/module/assets/sounds.zip
MediumNetwork
MediumShips Compressed Bloblib/module/assets/sounds.zip
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectionlib/module/assets/sounds.zip
Affected versions and remediation
This report applies to @dev_vlens/react-native-vlens@1.1.1.
See all versions of @dev_vlens/react-native-vlens for other recorded verdicts.
- Review the evidence and your use of @dev_vlens/react-native-vlens@1.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.