registry  /  @procivis/react-native-one-core  /  1.115411.0

@procivis/react-native-one-core@1.115411.0

ONE core bindings for React Native

AI Security Review

scanned 36m ago · by lpm-firewall-ai

Npm postinstall invokes the consuming project's Husky CLI when present, potentially configuring its Git hooks. Android Gradle and CocoaPods retrieve package-pinned native ONE Core artifacts with checksum verification. No confirmed hostile payload or data-exfiltration chain exists.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install with consumer Husky present; Gradle evaluation; CocoaPods prepare
Impact
May mutate consumer Git-hook setup and download native build dependencies; no confirmed credential theft, persistence beyond hooks, or remote code execution.
Mechanism
Host-project Husky setup and checksum-verified native SDK retrieval
Rationale
The conditional postinstall Husky invocation is a real, unconsented host-project VCS-hook setup action and warrants a warning. No concrete malicious chain supports a publish block.
Evidence
package.jsonbin/postinstalldist/index.jscore-sdk.jsonandroid/build.gradlereact-native-one-core.podspecandroid/src/main/java/ch/procivis/one/core/ProcivisOneCoreModule.ktios/ProcivisOneCoreModule.swiftnode_modules/huskyandroid/libs/onecore-debug.aarandroid/libs/onecore-release.aarios/deploy.zip
Network endpoints3
onesdk.blob.core.windows.net/core-sdk/115411/android/onecore-debug.aaronesdk.blob.core.windows.net/core-sdk/115411/android/onecore-release.aaronesdk.blob.core.windows.net/core-sdk/115411/ios/deploy.zip

Decision evidence

public snapshot
AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
  • `package.json` runs `node ./bin/postinstall` during installation.
  • `bin/postinstall` checks consumer `node_modules/husky` then executes `yarn husky install` with `execSync`.
  • `android/build.gradle` and `react-native-one-core.podspec` download native SDK archives during Android/iOS setup.
Evidence against
  • `dist/index.js` only wraps explicit React Native native-module calls.
  • No shipped JavaScript reads environment secrets, harvests files, evaluates code, or exfiltrates data.
  • Native SDK URLs and SHA-1 digests are pinned in `core-sdk.json`; Android and iOS setup verify them before use.
  • No AI-agent configuration, remote payload loader, or destructive behavior was found.
Behavioral surface
SourceNo risky source behavior triggered.
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 7 file(s), 29.4 KB of source

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node ./bin/postinstall
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node ./bin/postinstall
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium1 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowScripts Present