@onboarding-yak/react-native@0.8.3
Render remotely configured OnboardingYak onboarding flows in React Native apps.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe automatic network calls occur when the host app renders the onboarding component and use its configured service URL and API key. The documented analytics sends event metadata, not answers, and no install-time attack behavior was found.
Decision evidence
public snapshot- The package entry point is lib/index.js; package scripts are build, typecheck, and prepublishOnly, with no install hook.
- The flow fetch uses the caller-provided baseUrl and apiKey to retrieve the configured flow.
- Analytics events contain flow, screen, session, version, environment, platform, and optional variant metadata.
- The README documents automatic anonymous flow events and states that answer text and selected answers are not sent.
- Mounting the Onboarding component automatically fetches the flow and sends documented start and screen-view events.
Source & flagged code
5 flaggedThe package entry point is lib/index.js; package scripts are build, typecheck, and prepublishOnly, with no install hook.
package.jsonView on unpkg · L22The flow fetch uses the caller-provided baseUrl and apiKey to retrieve the configured flow.
lib/index.jsView on unpkg · L647Findings
Affected versions and remediation
This report applies to @onboarding-yak/react-native@0.8.3.
See all versions of @onboarding-yak/react-native for other recorded verdicts.
- Review the evidence and your use of @onboarding-yak/react-native@0.8.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.