registry / @onboarding-yak/react-native / 0.7.0
@onboarding-yak/react-native@0.7.0
Render remotely configured OnboardingYak onboarding flows in React Native apps.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe network activity matches the stated purpose of rendering remote onboarding flows and reporting documented, limited analytics. The manifest has no install hook; its prepublishOnly script only builds the package.
Static reason
No blocking static signals were detected.
Trigger
When the consuming app renders the Onboarding component and as the user moves through its flow.
Impact
The configured service receives flow and screen identifiers, an ephemeral session ID, flow version, environment, platform, and optional experiment labels; answer text and selected answers are not sent as analytics events.
Mechanism
Fetches the published flow and posts documented analytics events to routes on the baseUrl configured by the consuming app.
AI rationale
The network activity matches the stated purpose of rendering remote onboarding flows and reporting documented, limited analytics. The manifest has no install hook; its prepublishOnly script only builds the package.
Network endpoints2
<configured baseUrl>/api/flows/{flowId}<configured baseUrl>/api/events
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only lifecycle script is prepublishOnly, which runs the build.
- The SDK fetches the flow identified by the app’s flowId from the caller-configured baseUrl.
- Analytics events contain flow, screen, session, version, environment, platform, and optional experiment labels.
- The README documents automatic onboarding events and states that answer text and selected answers are not sent.
Evidence against
- The package performs network requests and sends analytics automatically when onboarding starts and progresses.
- The service URL and publishable API key are supplied by the consuming app.
Behavioral surface
Network
HighEntropyStrings
Source & flagged code
5 flaggedpackage.jsonView file
11"scripts": {
"build": "rm -rf lib && tsc -p tsconfig.build.json",
"typecheck": "tsc -p tsconfig.build.json --noEmit",
"prepublishOnly": "npm run build"
},
"publis
Low
Suspicious Lifecycle Evidence
The only lifecycle script is prepublishOnly, which runs the build.
package.jsonView on unpkg · L11lib/index.jsView file
610let loaded = fallbackFlow;
try {
const response = await fetch(`${baseUrl.replace(/\/$/, '')}/api/flows/${encodeURIComponent(flowId)}`, { headers: { [KEY_HEADER]: apiKey } });
if (response.status === 401 && __DEV__)
console.warn(apiKey.startsWith('oyk_')
? `OnboardingYak: api
Low
Ai Review Evidence
The SDK fetches the flow identified by the app’s flowId from the caller-configured baseUrl.
lib/index.jsView on unpkg · L610594body: JSON.stringify({ app_id: flowId, event_name, screen_id, session_id: sessionId, flow_version: version, environment: analyticsEnvironment, platform: Platform.OS === 'ios' ? 'ios' : Platform.OS === 'android' ? 'android' : 'other', ...(variant ? {
Findings
1 Medium8 Low
MediumNetwork
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencelib/index.js
LowAi Review Evidencelib/index.js
LowAi Review EvidenceREADME.md
LowAi Review EvidenceREADME.md
Affected versions and remediation
This report applies to @onboarding-yak/react-native@0.7.0.
See all versions of @onboarding-yak/react-native for other recorded verdicts.
- Review the evidence and your use of @onboarding-yak/react-native@0.7.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.