registry / @superrouteca/smap-react-native / 1.0.2

@superrouteca/smap-react-native@1.0.2

sMap for React Native: a map view for Superroute's sMap service, over the sMap Android and iOS SDKs.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The manifest has no install lifecycle hook, and the entry point exports map UI functionality. Native credential handling and the iOS build helper serve the documented map integration.

Static reason

No blocking static signals were detected.

Trigger

The app creates an SMap view; iOS framework embedding occurs during the app’s configured CocoaPods/Xcode build.

Impact

Normal map rendering, service requests, and native framework integration.

Mechanism

The wrapper forwards app-provided map settings and credentials to the native map SDK. The iOS helper embeds and signs the SDK framework from Xcode build products.

AI rationale

The manifest has no install lifecycle hook, and the entry point exports map UI functionality. Native credential handling and the iOS build helper serve the documented map integration.

Network endpoints3

tile.srsr.cagithub.comjitpack.io

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package entry point exports the map component and layer utilities; its scripts are tests, typechecking, and copying the license during prepack, with no install lifecycle hook.
The map accepts an app-supplied key or token and passes those values into the native map SDK when a map is created.
The iOS helper is documented as a CocoaPods build integration; it copies the MapLibre framework from Xcode build products into the app’s Frameworks folder and signs it when code signing is enabled.
Android resolves the documented sMap SDK dependency through JitPack or a local project dependency.
The README identifies the map service as the destination for app identity and documents the default service host.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 19.4 KB of source

Source & flagged code

9 flagged

ios/smap_react_native.rbView file

•path = ios/smap_react_native.rb kind = build_helper sizeBytes = 4146 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

ios/smap_react_native.rbView on unpkg

30EMBED_SCRIPT = <<~SH.freeze set -e src="${BUILT_PRODUCTS_DIR}/#{ENGINE}" dst="${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}" if [ ! -d "$src" ]; then echo "error: #{ENGINE} not found in ${BUILT_PRODUCTS_DIR}; run pod install again" exit 1 fi mkdir -p "$dst" rm -rf "$dst/#{ENGINE}" cp -R "$src" "$dst/" if [ "${CODE_SIGNING_ALLOWED}" = "YES" ] && [ -n "${EXPANDED_CODE_S

Low

Ai Review Evidence

The iOS helper is documented as a CocoaPods build integration; it copies the MapLibre framework from Xcode build products into the app’s Frameworks folder and signs it when code signing is enabled.

ios/smap_react_native.rbView on unpkg · L30

package.jsonView file

Findings

1 Medium9 Low

MediumShips Build Helperios/smap_react_native.rb

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Lifecycle Evidencesrc/index.tsx

LowAi Review Evidenceios/RNSMapHost.swift

LowAi Review Evidenceios/smap_react_native.rb

LowAi Review EvidenceREADME.md

LowSuspicious Dependency Evidenceandroid/build.gradle

LowAi Review EvidenceREADME.md

Affected versions and remediation

This report applies to @superrouteca/smap-react-native@1.0.2.

See all versions of @superrouteca/smap-react-native for other recorded verdicts.

Review the evidence and your use of @superrouteca/smap-react-native@1.0.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 14:44:14.631Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @superrouteca/smap-react-native / 1.0.2

@superrouteca/smap-react-native@1.0.2

sMap for React Native: a map view for Superroute's sMap service, over the sMap Android and iOS SDKs.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The manifest has no install lifecycle hook, and the entry point exports map UI functionality. Native credential handling and the iOS build helper serve the documented map integration.

Static reason

No blocking static signals were detected.

Trigger

The app creates an SMap view; iOS framework embedding occurs during the app’s configured CocoaPods/Xcode build.

Impact

Normal map rendering, service requests, and native framework integration.

Mechanism

The wrapper forwards app-provided map settings and credentials to the native map SDK. The iOS helper embeds and signs the SDK framework from Xcode build products.

AI rationale

The manifest has no install lifecycle hook, and the entry point exports map UI functionality. Native credential handling and the iOS build helper serve the documented map integration.

Network endpoints3

tile.srsr.cagithub.comjitpack.io

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package entry point exports the map component and layer utilities; its scripts are tests, typechecking, and copying the license during prepack, with no install lifecycle hook.
The map accepts an app-supplied key or token and passes those values into the native map SDK when a map is created.
The iOS helper is documented as a CocoaPods build integration; it copies the MapLibre framework from Xcode build products into the app’s Frameworks folder and signs it when code signing is enabled.
Android resolves the documented sMap SDK dependency through JitPack or a local project dependency.
The README identifies the map service as the destination for app identity and documents the default service host.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 19.4 KB of source

Source & flagged code

9 flagged

ios/smap_react_native.rbView file

•path = ios/smap_react_native.rb kind = build_helper sizeBytes = 4146 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

ios/smap_react_native.rbView on unpkg

Low

Ai Review Evidence

The iOS helper is documented as a CocoaPods build integration; it copies the MapLibre framework from Xcode build products into the app’s Frameworks folder and signs it when code signing is enabled.

ios/smap_react_native.rbView on unpkg · L30

package.jsonView file

Findings

1 Medium9 Low

MediumShips Build Helperios/smap_react_native.rb

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowSuspicious Lifecycle Evidencesrc/index.tsx

LowAi Review Evidenceios/RNSMapHost.swift

LowAi Review Evidenceios/smap_react_native.rb

LowAi Review EvidenceREADME.md

LowSuspicious Dependency Evidenceandroid/build.gradle

LowAi Review EvidenceREADME.md

Affected versions and remediation

This report applies to @superrouteca/smap-react-native@1.0.2.

See all versions of @superrouteca/smap-react-native for other recorded verdicts.

Review the evidence and your use of @superrouteca/smap-react-native@1.0.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 14:44:14.631Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.