@onboarding-yak/react-native@0.7.1
Render remotely configured OnboardingYak onboarding flows in React Native apps.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package’s network behavior is tied to rendering its onboarding component and uses the caller-supplied service URL and app key. Its analytics payload contains event metadata rather than answers, credentials, or unrelated machine data, and the manifest has no install-time hook.
Decision evidence
public snapshot- The package entrypoint is lib/index.js, and its only lifecycle script is prepublishOnly, which builds the package.
- Network requests are made by the Onboarding component using its supplied baseUrl, flowId and apiKey.
- Analytics send flow and screen identifiers, an ephemeral session ID, flow version, environment, platform and optional variant.
Source & flagged code
5 flaggedThe package entrypoint is lib/index.js, and its only lifecycle script is prepublishOnly, which builds the package.
package.jsonView on unpkg · L7The package entrypoint is lib/index.js, and its only lifecycle script is prepublishOnly, which builds the package.
package.jsonView on unpkg · L11Findings
Affected versions and remediation
This report applies to @onboarding-yak/react-native@0.7.1.
See all versions of @onboarding-yak/react-native for other recorded verdicts.
- Review the evidence and your use of @onboarding-yak/react-native@0.7.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.