@quinninc/rn-core@0.7.11
Follow this README.md for getting started.
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe package exposes an unvalidated eval path from remotely fetched template data into the app runtime. The inspected source supports a warning for this dangerous capability but does not establish malicious use.
Static reason
No blocking static signals were detected.
Trigger
An Imax widget renders a playlist template containing an aspect-ratio prop.
Impact
A crafted template value could execute JavaScript in the app runtime; the inspected source does not show a malicious payload or establish that this capability is exploited.
Mechanism
The renderer forwards template props to the video component, which passes the aspect-ratio prop to eval without validation.
AI rationale
The package exposes an unvalidated eval path from remotely fetched template data into the app runtime. The inspected source supports a warning for this dangerous capability but does not establish malicious use.
Evidence
components/ImaxVideo.jscomponents/ImaxCarousal.jscore/Renderer/Renderer.jshooks/usePlaylist.jsconnectors/general.jsconnectors/shopify.js
Network endpoints2
assets.quinn.livethe configured Shopify shop domain
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest lists no install or import lifecycle hooks.
- The video component evaluates its aspect-ratio prop as JavaScript.
- The Imax carousel renders a template stored in playlist data.
- The JSON renderer forwards template props directly to components.
- Playlist data is fetched through a connector and placed in component state.
- Connector playlist data comes from the Quinn CDN or a Shopify metaobject.
Evidence against
- The evaluated value is used as a video layout ratio, consistent with parsing an arithmetic ratio.
- The inspected code does not show a payload or other malicious expression being supplied.
Behavioral surface
EvalNetwork
UrlStrings
Source & flagged code
9 flaggedcomponents/ImaxVideo.jsView file
9return (<Video source={{ uri: mediaSrc }} style={{
backgroundColor: "red",
aspectRatio: eval(props.aspectRatio) ?? 9 / 16,
Medium
Ai Review Evidence
The video component evaluates its aspect-ratio prop as JavaScript.
components/ImaxVideo.jsView on unpkg · L910backgroundColor: "red",
L11: aspectRatio: eval(props.aspectRatio) ?? 9 / 16,
L12: width: "100%",
Low
Eval
Package source references a known benign dynamic code generation pattern.
components/ImaxVideo.jsView on unpkg · L10components/BoatAddToCartButton.jsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 67
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
Findings
1 High8 Medium3 Low
HighSemantic Analysis Limitedcomponents/BoatAddToCartButton.js
MediumNetwork
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencecomponents/ImaxVideo.js
MediumAi Review Evidencecomponents/ImaxCarousal.js
MediumAi Review Evidencecore/Renderer/Renderer.js
MediumAi Review Evidencehooks/usePlaylist.js
MediumAi Review Evidencehooks/usePlaylist.js
MediumAi Review Evidenceconnectors/general.js
LowScripts Present
LowEvalcomponents/ImaxVideo.js
LowUrl Strings
Affected versions and remediation
This report applies to @quinninc/rn-core@0.7.11.
See all versions of @quinninc/rn-core for other recorded verdicts.
- Review the evidence and your use of @quinninc/rn-core@0.7.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.