@hmscore/react-native-hms-analytics
React Native HMS Analytics Kit
This report shows the evidence for @hmscore/react-native-hms-analytics@6.12.0-303. 0 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package’s core analytics bridge matches its stated purpose, but its Android wrapper also enables a separate plugin logger by default. That logger sends app and API usage metadata to Huawei Analytics without clear package-level disclosure, so this is suspicious runtime telemetry rather than an identified malicious attack.
Decision evidence
public snapshot- The Android logger enables itself in its constructor, so its telemetry is on by default.
- When enabled, the logger sends event maps through Huawei’s HiAnalytics utility.
- Those maps include the app ID, package name, and app version; per-call data includes API name, result, and timing.
- The wrapper initializes the logger when handling analytics API calls.
- The package is described as a React Native bridge to Huawei Analytics, and its public API exposes analytics operations.
- The package README does not describe the separate plugin-usage telemetry or explain that it is enabled by default.
- The source does not identify a concrete telemetry hostname.
Source & flagged code
7 flaggedPackage ships non-JavaScript build or shell helper files.
example/android/gradlew.batView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
example/App.jsView on unpkgFindings
Affected versions and remediation
This report applies to @hmscore/react-native-hms-analytics@6.12.0-303.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @hmscore/react-native-hms-analytics@6.12.0-303 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.