@hmscore/react-native-hms-awareness@3.8.0-303
React Native HMS Awareness Kit
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe source enables Huawei analytics by default and sends runtime app and device metadata during Awareness API use. The package does not document this telemetry, so this is suspicious rather than a confirmed malicious data theft; no analytics host is hard-coded in the reviewed source.
Static reason
No blocking static signals were detected.
Trigger
A caller invokes an Awareness capture or barrier API; logger initialization enables telemetry by default.
Impact
Huawei analytics receives app and device metadata. The reviewed event maps do not include captured location or other Awareness results.
Mechanism
The native logger sends Huawei analytics events containing app identifiers and versions, API name, result, timing, device model and network type.
AI rationale
The source enables Huawei analytics by default and sends runtime app and device metadata during Awareness API use. The package does not document this telemetry, so this is suspicious rather than a confirmed malicious data theft; no analytics host is hard-coded in the reviewed source.
Evidence
android/src/main/java/com/huawei/hms/rn/awareness/logger/HMSLogger.javaandroid/src/main/java/com/huawei/hms/rn/awareness/wrapper/AwarenessCaptureWrapper.javaandroid/src/main/java/com/huawei/hms/rn/awareness/modules/HMSLoggerModule.java
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The logger initializes Huawei analytics and enables logging by default when first created.
- Calling an Awareness capture method starts logging and sends an event after the API succeeds.
- The event maps include app ID, app package and version, API name, result, call time, device model and network type.
- The package exposes a method to disable logging, but the README does not document the telemetry.
Evidence against
- The package has no lifecycle scripts, and its JavaScript entry point only exports native modules.
- Telemetry is tied to calls to Awareness APIs; the logger code does not include location or other capture results in its event maps.
- The package provides an explicit disableLogger method.
Behavioral surface
HighEntropyStrings
Source & flagged code
7 flaggedexample/android/gradlew.batView file
•path = example/android/gradlew.bat
kind = build_helper
sizeBytes = 2674
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
example/android/gradlew.batView on unpkgexample/App.jsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
example/App.jsView on unpkgandroid/src/main/java/com/huawei/hms/rn/awareness/logger/HMSLogger.javaView file
Findings
1 High6 Medium1 Low
HighSemantic Analysis Limitedexample/App.js
MediumShips Build Helperexample/android/gradlew.bat
MediumAi Review Evidenceandroid/src/main/java/com/huawei/hms/rn/awareness/logger/HMSLogger.java
MediumAi Review Evidenceandroid/src/main/java/com/huawei/hms/rn/awareness/logger/HMSLogger.java
MediumAi Review Evidenceandroid/src/main/java/com/huawei/hms/rn/awareness/wrapper/AwarenessCaptureWrapper.java
MediumAi Review Evidenceandroid/src/main/java/com/huawei/hms/rn/awareness/logger/HMSLogger.java
MediumAi Review Evidenceandroid/src/main/java/com/huawei/hms/rn/awareness/logger/HMSLogger.java
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @hmscore/react-native-hms-awareness@3.8.0-303.
See all versions of @hmscore/react-native-hms-awareness for other recorded verdicts.
- Review the evidence and your use of @hmscore/react-native-hms-awareness@3.8.0-303 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.