@quinninc/rn-core@0.7.20
Follow this README.md for getting started.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package sends runtime media-view telemetry to Quinn by default: the five-second view event bypasses the configured event list and includes store and persistent random identifiers. No disclosure or opt-out was found in the package README, so this merits a warning rather than a malicious verdict.
Static reason
No blocking static signals were detected.
Trigger
The SDK’s analytics hook observes a media index change and schedules a view-count event after five seconds.
Impact
Quinn can associate media-view activity with a store and persistent session or distinct identifiers; no disclosure or opt-out was found in the package README.
Mechanism
A built-in event allowlist bypasses the configured event list, and the analytics request posts event data with persistent random identifiers and store information to events.quinn.live.
AI rationale
The package sends runtime media-view telemetry to Quinn by default: the five-second view event bypasses the configured event list and includes store and persistent random identifiers. No disclosure or opt-out was found in the package README, so this merits a warning rather than a malicious verdict.
Evidence
analytics/utils.jshooks/useAnalytics.jsanalytics/request.js
Network endpoints5
events.quinn.live/events${shop}/api/${version}/graphql.jsonassets.quinn.live/${payload.paginatedHash}assets.quinn.live/${this.shop}/${handleHash}.jsonassets.quinn.live/${this.shop}/settings.json
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The `quinn_events_5secview` event is allowed regardless of the configured event list.
- When the active media index changes, the analytics hook schedules a view-count event after five seconds.
- Analytics events are POSTed to Quinn with session and distinct IDs, store name, app version, and event measures.
- The Shopify access token is sent to the configured shop’s Shopify GraphQL endpoint.
Evidence against
- The package manifest declares no install, preinstall, or postinstall lifecycle hooks.
- The main entry point exports SDK components and types; it does not itself initiate requests.
- The Shopify token is sent to the shop domain’s Shopify API, and the analytics payload describes SDK usage rather than collecting machine credentials.
Behavioral surface
EvalNetwork
UrlStrings
Source & flagged code
8 flaggedcomponents/ImaxVideo.jsView file
10backgroundColor: "red",
L11: aspectRatio: eval(props.aspectRatio) ?? 9 / 16,
L12: width: "100%",
Low
Eval
Package source references a known benign dynamic code generation pattern.
components/ImaxVideo.jsView on unpkg · L10components/BoatAddToCartButton.jsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 67
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
components/BoatAddToCartButton.jsView on unpkganalytics/utils.jsView file
Findings
1 High7 Medium3 Low
HighSemantic Analysis Limitedcomponents/BoatAddToCartButton.js
MediumNetwork
MediumAi Review Evidenceanalytics/utils.js
MediumAi Review Evidenceanalytics/utils.js
MediumAi Review Evidencehooks/useAnalytics.js
MediumAi Review Evidenceanalytics/request.js
MediumAi Review Evidenceanalytics/request.js
MediumAi Review Evidenceutils/request.js
LowScripts Present
LowEvalcomponents/ImaxVideo.js
LowUrl Strings
Affected versions and remediation
This report applies to @quinninc/rn-core@0.7.20.
See all versions of @quinninc/rn-core for other recorded verdicts.
- Review the evidence and your use of @quinninc/rn-core@0.7.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.