registry / @hmscore/react-native-hms-analytics / 6.12.0-302
@hmscore/react-native-hms-analytics@6.12.0-302
React Native HMS Analytics Kit
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource inspection found a conventional React Native analytics wrapper with no lifecycle hooks or malicious execution primitives. The flagged example is a demo that calls the same analytics API exposed by the package.
Static reason
No blocking static signals were detected.
Trigger
An Android app includes the package and starts, or application code invokes its analytics methods.
Impact
The package enables analytics and identifier-related SDK functions, but no package code shows unconsented exfiltration, shell execution, persistence, or project mutation.
Mechanism
React Native bridge to the HiAnalytics SDK.
AI rationale
Source inspection found a conventional React Native analytics wrapper with no lifecycle hooks or malicious execution primitives. The flagged example is a demo that calls the same analytics API exposed by the package.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares a React Native library entry and contains no lifecycle-script field.
- The flagged demo initializes HMS Analytics only when its Android component mounts.
- The JavaScript API delegates calls to the React Native native module.
- The Android provider is not exported and initializes the declared HiAnalytics SDK.
Evidence against
- No install-time code, shell execution, dynamic evaluation, credential harvesting, or package-owned network client was found.
- Analytics and identifier APIs are exposed as explicit app-facing SDK calls; no unrelated file or project mutation was found.
Behavioral surface
Source & flagged code
8 flaggedexample/android/gradlew.batView file
•path = example/android/gradlew.bat
kind = build_helper
sizeBytes = 2674
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
example/android/gradlew.batView on unpkgexample/App.jsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
example/App.jsView on unpkg43componentDidMount() {
super.pickerView(pickerType.logLevel.toString());
if (!this.state.isInstanceAvailable && Platform.OS === "android") {
HMSAnalytics.getInstance()
.then((res) => {
this.setState({ isInstanceAvailable: true });
super.showResult(apiName.getInstance, res);
})
.catch((err) => super.showResult(apiName.getInstance, err));
}
Findings
1 High1 Medium6 Low
HighSemantic Analysis Limitedexample/App.js
MediumShips Build Helperexample/android/gradlew.bat
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceexample/App.js
LowAi Review Evidencesrc/index.js
LowAi Review Evidenceandroid/src/main/AndroidManifest.xml
LowAi Review Evidenceandroid/src/main/java/com/huawei/hms/rn/analytics/HMSAnalyticsProvider.java
LowAi Review Evidenceandroid/src/main/java/com/huawei/hms/rn/analytics/HMSAnalyticsProvider.java
Affected versions and remediation
This report applies to @hmscore/react-native-hms-analytics@6.12.0-302.
See all versions of @hmscore/react-native-hms-analytics for other recorded verdicts.
- Review the evidence and your use of @hmscore/react-native-hms-analytics@6.12.0-302 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.