registry / @quinninc/rn-core / 0.7.19
@quinninc/rn-core@0.7.19
Follow this README.md for getting started.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe inspected entry point exposes storefront components and app configuration, with no install hooks. The Shopify token is sent to the configured shop, analytics is event-gated and sent to the vendor's collector, and the eval use is limited to a video sizing prop.
Static reason
No blocking static signals were detected.
Trigger
The Shopify client sends requests when its returned query function is called; analytics sends events when an allowed event occurs; the video component evaluates aspectRatio during rendering.
Impact
Observed network and dynamic-code behavior serves the package's storefront and analytics functions; no malicious behavior was found.
Mechanism
The Shopify client sends its caller-provided token to the caller-provided shop host. Analytics posts event data to events.quinn.live and applies an event allowlist. Video sizing uses eval on the aspectRatio prop.
AI rationale
The inspected entry point exposes storefront components and app configuration, with no install hooks. The Shopify token is sent to the configured shop, analytics is event-gated and sent to the vendor's collector, and the eval use is limited to a video sizing prop.
Network endpoints2
${shop}/api/${version}/graphql.jsonevents.quinn.live/events
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package entry point exports UI components and app configuration; no install lifecycle hook is declared.
- The GraphQL client sends its supplied Storefront token to the supplied shop's Shopify API endpoint.
- Analytics events are gated by configured event names, with one five-second view event explicitly allowlisted.
- The analytics collector is the package vendor's events.quinn.live endpoint.
- The video component evaluates a supplied aspectRatio prop while rendering video styling.
Evidence against
- The package scripts are React Native run/start/build/deploy commands; there are no preinstall, install, or postinstall scripts.
- The network requests shown are consistent with the Shopify client and the vendor's product analytics.
Behavioral surface
EvalNetwork
UrlStrings
Source & flagged code
8 flaggedcomponents/ImaxVideo.jsView file
10backgroundColor: "red",
L11: aspectRatio: eval(props.aspectRatio) ?? 9 / 16,
L12: width: "100%",
Low
Eval
Package source references a known benign dynamic code generation pattern.
components/ImaxVideo.jsView on unpkg · L109return (<Video source={{ uri: mediaSrc }} style={{
backgroundColor: "red",
aspectRatio: eval(props.aspectRatio) ?? 9 / 16,
Low
Ai Review Evidence
The video component evaluates a supplied aspectRatio prop while rendering video styling.
components/ImaxVideo.jsView on unpkg · L9components/BoatAddToCartButton.jsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 67
High
Semantic Analysis Limited
Findings
1 High1 Medium9 Low
HighSemantic Analysis Limitedcomponents/BoatAddToCartButton.js
MediumNetwork
LowScripts Present
LowEvalcomponents/ImaxVideo.js
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidenceindex.js
LowAi Review Evidenceutils/request.js
LowAi Review Evidenceanalytics/utils.js
LowAi Review Evidenceanalytics/request.js
LowAi Review Evidencecomponents/ImaxVideo.js
Affected versions and remediation
This report applies to @quinninc/rn-core@0.7.19.
See all versions of @quinninc/rn-core for other recorded verdicts.
- Review the evidence and your use of @quinninc/rn-core@0.7.19 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.