@hmscore/react-native-hms-analytics@6.12.0-303
React Native HMS Analytics Kit
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package’s core analytics bridge matches its stated purpose, but its Android wrapper also enables a separate plugin logger by default. That logger sends app and API usage metadata to Huawei Analytics without clear package-level disclosure, so this is suspicious runtime telemetry rather than an identified malicious attack.
Decision evidence
public snapshot- The Android logger enables itself in its constructor, so its telemetry is on by default.
- When enabled, the logger sends event maps through Huawei’s HiAnalytics utility.
- Those maps include the app ID, package name, and app version; per-call data includes API name, result, and timing.
- The wrapper initializes the logger when handling analytics API calls.
- The package is described as a React Native bridge to Huawei Analytics, and its public API exposes analytics operations.
- The package README does not describe the separate plugin-usage telemetry or explain that it is enabled by default.
- The source does not identify a concrete telemetry hostname.
Source & flagged code
7 flaggedPackage ships non-JavaScript build or shell helper files.
example/android/gradlew.batView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
example/App.jsView on unpkgThe Android logger enables itself in its constructor, so its telemetry is on by default.
android/src/main/java/com/huawei/hms/rn/analytics/logger/HMSLogger.javaView on unpkg · L84When enabled, the logger sends event maps through Huawei’s HiAnalytics utility.
android/src/main/java/com/huawei/hms/rn/analytics/logger/HMSLogger.javaView on unpkg · L185Those maps include the app ID, package name, and app version; per-call data includes API name, result, and timing.
android/src/main/java/com/huawei/hms/rn/analytics/logger/HMSLogger.javaView on unpkg · L263Those maps include the app ID, package name, and app version; per-call data includes API name, result, and timing.
android/src/main/java/com/huawei/hms/rn/analytics/logger/HMSLogger.javaView on unpkg · L284The wrapper initializes the logger when handling analytics API calls.
android/src/main/java/com/huawei/hms/rn/analytics/HMSAnalyticsWrapper.javaView on unpkg · L88Findings
Affected versions and remediation
This report applies to @hmscore/react-native-hms-analytics@6.12.0-303.
See all versions of @hmscore/react-native-hms-analytics for other recorded verdicts.
- Review the evidence and your use of @hmscore/react-native-hms-analytics@6.12.0-303 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.