registry / Malware / @superrouteca/smap-react-native

@superrouteca/smap-react-native

sMap for React Native: a map view for Superroute's sMap service, over the sMap Android and iOS SDKs, with standard style layers, basemap overrides, data formats and external layers.

This report shows the evidence for @superrouteca/smap-react-native@1.1.1. 1 of 35 known versions is blocked or flagged. The newest version, 1.5.15, is allowed. See all versions.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The map view enables offline auto-refresh by default, and the package documents that those automatic refreshes are billed downloads. This can spend the user’s quota or incur charges without an explicit request to refresh each region, so the package is malicious under the automatic spending rule.

Static reason

No blocking static signals were detected.

Trigger

An app mounts or recreates an SMap view while saved regions are nearing expiry; auto-refresh is enabled unless explicitly disabled.

Impact

Unrequested tile downloads can consume the user’s quota or incur charges.

Mechanism

SMap passes the default-enabled auto-refresh setting and map credentials to the native SDK, which refreshes eligible regions while online.

Attack narrative

When an app mounts a map, the package enables offline auto-refresh by default; the documented behavior downloads saved regions nearing expiry and bills those downloads by tile, without requiring the app to explicitly request each refresh.

AI rationale

Evidence

src/SMap.tsxandroid/src/main/java/ca/superroute/smap/reactnative/SMapReactView.ktios/RNSMapHost.swiftREADME.md

Network endpoints1

tile.srsr.ca

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

SMap sets offlineAutoRefresh to true unless the app explicitly passes false.
The native iOS and Android map setup both default auto-refresh to true.
The README says an online map refreshes saved regions nearing expiry automatically and that downloads are billed by tile.
The documented default map service is https://tile.srsr.ca.

Evidence against

Offline maps and region management are part of the package’s stated mapping purpose.
The manifest has no install, preinstall or postinstall hook; its prepack script only copies the license.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 52.6 KB of source

Source & flagged code

6 flagged

ios/smap_react_native.rbView file

•path = ios/smap_react_native.rb kind = build_helper sizeBytes = 4146 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

ios/smap_react_native.rbView on unpkg

src/SMap.tsxView file

195offlineRegion: offlineRegion || null, offlineFallback: offlineFallback !== false, offlineAutoRefresh: offlineAutoRefresh !== false, }); const camera = cameraJson({ center, zo

High

Ai Review Evidence

SMap sets offlineAutoRefresh to true unless the app explicitly passes false.

src/SMap.tsxView on unpkg · L195

140/** Node URLs known in advance, used while `baseUrl` is down. */ nodes?: string[]; /** The map service, `https://tile.srsr.ca` by default. */ baseUrl?: stri

High

Findings

5 High1 Medium2 Low

HighAi Review Evidencesrc/SMap.tsx

HighAi Review Evidenceios/RNSMapHost.swift

HighAi Review Evidenceandroid/src/main/java/ca/superroute/smap/reactnative/SMapReactView.kt

HighAi Review EvidenceREADME.md

HighAi Review Evidencesrc/SMap.tsx

MediumShips Build Helperios/smap_react_native.rb

LowScripts Present

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @superrouteca/smap-react-native@1.1.1.

The versions list below shows the verdict for each recorded version.

Avoid installing @superrouteca/smap-react-native@1.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-29 14:44:45.195Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

35 known versions

1.5.15latestUnknown—AllowUnder ReviewNov 1, 2026, 6:11 AM 1.5.12Unknown—AllowUnder ReviewOct 31, 2026, 3:36 PM 1.5.11Unknown—AllowUnder ReviewOct 31, 2026, 2:58 PM 1.5.10Unknown—AllowUnder ReviewOct 31, 2026, 2:45 PM

registry / Malware / @superrouteca/smap-react-native

@superrouteca/smap-react-native

sMap for React Native: a map view for Superroute's sMap service, over the sMap Android and iOS SDKs, with standard style layers, basemap overrides, data formats and external layers.

This report shows the evidence for @superrouteca/smap-react-native@1.1.1. 1 of 35 known versions is blocked or flagged. The newest version, 1.5.15, is allowed. See all versions.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

An app mounts or recreates an SMap view while saved regions are nearing expiry; auto-refresh is enabled unless explicitly disabled.

Impact

Unrequested tile downloads can consume the user’s quota or incur charges.

Mechanism

SMap passes the default-enabled auto-refresh setting and map credentials to the native SDK, which refreshes eligible regions while online.

Attack narrative

AI rationale

Evidence

src/SMap.tsxandroid/src/main/java/ca/superroute/smap/reactnative/SMapReactView.ktios/RNSMapHost.swiftREADME.md

Network endpoints1

tile.srsr.ca

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

SMap sets offlineAutoRefresh to true unless the app explicitly passes false.
The native iOS and Android map setup both default auto-refresh to true.
The README says an online map refreshes saved regions nearing expiry automatically and that downloads are billed by tile.
The documented default map service is https://tile.srsr.ca.

Evidence against

Offline maps and region management are part of the package’s stated mapping purpose.
The manifest has no install, preinstall or postinstall hook; its prepack script only copies the license.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 52.6 KB of source

Source & flagged code

6 flagged

ios/smap_react_native.rbView file

•path = ios/smap_react_native.rb kind = build_helper sizeBytes = 4146 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

ios/smap_react_native.rbView on unpkg

src/SMap.tsxView file

195offlineRegion: offlineRegion || null, offlineFallback: offlineFallback !== false, offlineAutoRefresh: offlineAutoRefresh !== false, }); const camera = cameraJson({ center, zo

High

Ai Review Evidence

SMap sets offlineAutoRefresh to true unless the app explicitly passes false.

src/SMap.tsxView on unpkg · L195

140/** Node URLs known in advance, used while `baseUrl` is down. */ nodes?: string[]; /** The map service, `https://tile.srsr.ca` by default. */ baseUrl?: stri

High

Findings

5 High1 Medium2 Low

HighAi Review Evidencesrc/SMap.tsx

HighAi Review Evidenceios/RNSMapHost.swift

HighAi Review Evidenceandroid/src/main/java/ca/superroute/smap/reactnative/SMapReactView.kt

HighAi Review EvidenceREADME.md

HighAi Review Evidencesrc/SMap.tsx

MediumShips Build Helperios/smap_react_native.rb

LowScripts Present

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @superrouteca/smap-react-native@1.1.1.

The versions list below shows the verdict for each recorded version.

Avoid installing @superrouteca/smap-react-native@1.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-29 14:44:45.195Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

35 known versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Runtime surface

Behavioral surface

Related packages

Other malware packages