@quinninc/rn-core@0.7.16
Follow this README.md for getting started.
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe package exposes an unvalidated JavaScript evaluation path for a runtime template value loaded through its playlist flow. This warrants a warning for remote code execution capability, but the inspected source does not establish an active attack.
Decision evidence
public snapshot- The Imax video component evaluates its aspect ratio prop as JavaScript.
- The Imax template is rendered with package components, and the renderer forwards template props to those components.
- The playlist hook loads playlist data through the configured connector before rendering it.
- The general connector fetches playlist data from assets.quinn.live.
- The inspected network request is to the package's Quinn playlist service; the source does not establish a malicious payload or exploit.
Source & flagged code
7 flaggedThe Imax video component evaluates its aspect ratio prop as JavaScript.
components/ImaxVideo.jsView on unpkg · L11Package source references a known benign dynamic code generation pattern.
components/ImaxVideo.jsView on unpkg · L10A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
Findings
Affected versions and remediation
This report applies to @quinninc/rn-core@0.7.16.
See all versions of @quinninc/rn-core for other recorded verdicts.
- Review the evidence and your use of @quinninc/rn-core@0.7.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.