registry / @superrouteca/smap-react-native / 1.0.0
@superrouteca/smap-react-native@1.0.0
React Native map view for Superroute's sMap service, over the sMap Android and iOS SDKs.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package has no install hook, and its entry point only exports the map API. The flagged iOS helper performs documented SDK linking and framework embedding, while token retrieval depends on a consumer-provided callback.
Static reason
No blocking static signals were detected.
Trigger
The map is created when a consumer renders the component. The iOS helper runs when the consumer invokes it from the Podfile.
Impact
No malicious impact identified. Network access and build output changes support the advertised map functionality.
Mechanism
The component passes map configuration and optional token callbacks to the native SDK. The iOS helper links the sMap package and embeds its MapLibre framework in the app build.
AI rationale
The package has no install hook, and its entry point only exports the map API. The flagged iOS helper performs documented SDK linking and framework embedding, while token retrieval depends on a consumer-provided callback.
Evidence
ios/smap_react_native.rb${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}/MapLibre.framework
Network endpoints3
tile.srsr.cagithub.com/Goodneo-Solutions/smap-sdk.gitjitpack.io
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- There are no install lifecycle scripts; the declared scripts are for testing, type checking, and copying the license during prepack.
- The package entry point exports the map component, hooks, layers, and data helpers.
- The CocoaPods helper links the documented sMap SDK and adds a build phase to embed its MapLibre framework.
- Token renewal is optional: the component requests a token through the getToken callback supplied by its consumer.
Evidence against
- The map SDK uses network services for map functionality, including the documented default tile service.
Behavioral surface
Source & flagged code
7 flaggedios/smap_react_native.rbView file
•path = ios/smap_react_native.rb
kind = build_helper
sizeBytes = 4146
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
ios/smap_react_native.rbView on unpkg64# Called by the podspec.
def self.add_to_pod(spec)
local = local_sdk
if local
spm_dependency(spec, url: local, requirement: {}, products: [PRODUCT])
else
spm_dependency(spec, url: REMOTE, requirement: { kind: "exactVersion", version: version }, products: [PRODUCT])
end
end
# Adds the embed phase to every app target of the Podfile (once; kept up to date).
def self.post_install(installer)
inputs = ["${BUILT_PRODUCTS_DIR}/#{ENGINE}"]
outputs
Low
Ai Review Evidence
The CocoaPods helper links the documented sMap SDK and adds a build phase to embed its MapLibre framework.
ios/smap_react_native.rbView on unpkg · L6428# Copies the engine framework from the build products (where Xcode puts the package's binary framework) into the
# app's Frameworks folder and signs it as the app is signed.
EMBED_SCRIPT = <<~SH.freeze
set -e
src="${BUILT_PRODUCTS_DIR}/#{ENGINE}"
dst="${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}"
if [ ! -d "$src" ]; then
echo "error: #{ENGINE} not found in ${BUILT_PRODUCTS_DIR}; run pod install again"
Findings
1 Medium7 Low
MediumShips Build Helperios/smap_react_native.rb
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/index.tsx
LowAi Review Evidenceios/smap_react_native.rb
LowAi Review Evidenceios/smap_react_native.rb
LowAi Review Evidencesrc/SMap.tsx
LowAi Review Evidencesrc/SMap.tsx
Affected versions and remediation
This report applies to @superrouteca/smap-react-native@1.0.0.
See all versions of @superrouteca/smap-react-native for other recorded verdicts.
- Review the evidence and your use of @superrouteca/smap-react-native@1.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.