@onboarding-yak/react-native@0.8.2
Render remotely configured OnboardingYak onboarding flows in React Native apps.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe network calls are tied to mounting and using the onboarding component, and use the app-provided service URL and publishable key. Analytics are disclosed and limited to flow metadata; the source and manifest show no malicious behavior.
Decision evidence
public snapshot- The package describes its purpose as rendering remotely configured OnboardingYak flows in React Native apps.
- The manifest points to lib/index.js and declares sideEffects false; its only lifecycle script is prepublishOnly, which builds the package.
- When the onboarding flow is loaded, the component requests its flow from the supplied baseUrl using the app's API key.
- Runtime analytics sends flow and screen identifiers, event names, session IDs, flow versions, environment labels and platform labels.
- The README discloses the analytics events and states that answer text and selected answers are not sent.
Source & flagged code
5 flaggedThe package describes its purpose as rendering remotely configured OnboardingYak flows in React Native apps.
package.jsonView on unpkg · L1The manifest points to lib/index.js and declares sideEffects false; its only lifecycle script is prepublishOnly, which builds the package.
package.jsonView on unpkg · L7Findings
Affected versions and remediation
This report applies to @onboarding-yak/react-native@0.8.2.
See all versions of @onboarding-yak/react-native for other recorded verdicts.
- Review the evidence and your use of @onboarding-yak/react-native@0.8.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.