registry / @react-native-oh/react-native-harmony / 0.84.2

@react-native-oh/react-native-harmony@0.84.2

Please refer to: [RNOH repo](https://gitcode.com/CPF-RN/ohos_react_native) for more detail.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 720 file(s), 5.23 MB of source, external domains: example.org, fburl.com, github.com, picsum.photos, react.dev, reactnative.dev, seeklogo.com, test.com

Source & flagged code

4 flagged

types/__typetests__/index.tsxView file

Lines 1114-1154tsx

1114 'Enter your password to claim your $1.5B in lottery winnings',

1115 text => {

1116 console.log(text);

1117 },

1118 'secure-text',

1119);

1120

1121Alert.prompt(

1122 'Enter password',

1123 'Enter your password to claim your $1.5B in lottery winnings',

1124 [

1125 {

1126 text: 'Cancel',

1127 onPress: () => console.log('Cancel Pressed'),

1128 style: 'cancel',

1129 },

1130 {

1131 text: 'OK',

1132 isPreferred: true,

1133 onPress: (password?: string) =>

1134 console.log('OK Pressed, password: ' + password),

Medium

Secret Pattern

Package contains a possible secret pattern.

types/__typetests__/index.tsxView on unpkg · L1134

1135 },

1136 ],

1137 'secure-text',

1138);

1139

1140class InputAccessoryViewTest extends React.Component {

1141 render() {

1142 const uniqueID = 'foobar';

1143 return (

1144 <InputAccessoryView nativeID={uniqueID}>

1145 <TextInput inputAccessoryViewID={uniqueID} />

1146 </InputAccessoryView>

1147 );

1148 }

1149}

1150

1151// DeviceEventEmitter

1152const deviceEventEmitter: typeof DeviceEventEmitter = DeviceEventEmitter;

1153deviceEventEmitter.addListener('keyboardWillShow', data => true);

1154deviceEventEmitter.addListener('keyboardWillShow', data => true, {});

Libraries/Core/Devtools/loadBundleFromServer.jsView file

Lines 163-200javascript

163 // Errors are returned as JSON.

164 throw new LoadBundleFromServerError(

165 'Could not load bundle',

166 bundlePathAndQuery,

167 false, // isTimeout

168 {

169 cause:

170 JSON

react_native_openharmony.harView file

•path = react_native_openharmony.har kind = high_entropy_blob sizeBytes = 159004761 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

react_native_openharmony.harView on unpkg

•path = react_native_openharmony.har kind = compressed_blob sizeBytes = 159004761 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

react_native_openharmony.harView on unpkg

Source & flagged code

4 flagged · loading source

types/__typetests__/index.tsxView file

1134patternName = generic_password severity = medium line = 1134 matchedText = console....rd),

Medium

Secret Pattern

Package contains a possible secret pattern.

types/__typetests__/index.tsxView on unpkg · L1134

Libraries/Core/Devtools/loadBundleFromServer.jsView file

183// eslint-disable-next-line no-eval L184: eval(body); L185: }

High

Eval

Package source references dynamic code evaluation.

Libraries/Core/Devtools/loadBundleFromServer.jsView on unpkg · L183

react_native_openharmony.harView file

•path = react_native_openharmony.har kind = high_entropy_blob sizeBytes = 159004761 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

react_native_openharmony.harView on unpkg

•path = react_native_openharmony.har kind = compressed_blob sizeBytes = 159004761 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

react_native_openharmony.harView on unpkg

Findings

2 High5 Medium4 Low

HighEvalLibraries/Core/Devtools/loadBundleFromServer.js

HighShips High Entropy Blobreact_native_openharmony.har

MediumSecret Patterntypes/__typetests__/index.tsx

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobreact_native_openharmony.har

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

types/__typetests__/index.tsxView file

Lines 1114-1154tsx

1114 'Enter your password to claim your $1.5B in lottery winnings',

1115 text => {

1116 console.log(text);

1117 },

1118 'secure-text',

1119);

1120

1121Alert.prompt(

1122 'Enter password',

1123 'Enter your password to claim your $1.5B in lottery winnings',

1124 [

1125 {

1126 text: 'Cancel',

1127 onPress: () => console.log('Cancel Pressed'),

1128 style: 'cancel',

1129 },

1130 {

1131 text: 'OK',

1132 isPreferred: true,

1133 onPress: (password?: string) =>

1134 console.log('OK Pressed, password: ' + password),

Medium

Secret Pattern

Package contains a possible secret pattern.

types/__typetests__/index.tsxView on unpkg · L1134

1135 },

1136 ],

1137 'secure-text',

1138);

1139

1140class InputAccessoryViewTest extends React.Component {

1141 render() {

1142 const uniqueID = 'foobar';

1143 return (

1144 <InputAccessoryView nativeID={uniqueID}>

1145 <TextInput inputAccessoryViewID={uniqueID} />

1146 </InputAccessoryView>

1147 );

1148 }

1149}

1150

1151// DeviceEventEmitter

1152const deviceEventEmitter: typeof DeviceEventEmitter = DeviceEventEmitter;

1153deviceEventEmitter.addListener('keyboardWillShow', data => true);

1154deviceEventEmitter.addListener('keyboardWillShow', data => true, {});

Libraries/Core/Devtools/loadBundleFromServer.jsView file

Lines 163-200javascript

163 // Errors are returned as JSON.

164 throw new LoadBundleFromServerError(

165 'Could not load bundle',

166 bundlePathAndQuery,

167 false, // isTimeout

168 {

169 cause:

170 JSON

react_native_openharmony.harView file

•path = react_native_openharmony.har kind = high_entropy_blob sizeBytes = 159004761 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

react_native_openharmony.harView on unpkg

•path = react_native_openharmony.har kind = compressed_blob sizeBytes = 159004761 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

react_native_openharmony.harView on unpkg