registry / @superrouteca/smap-react-native / 1.0.5
@superrouteca/smap-react-native@1.0.5
sMap for React Native: a map view for Superroute's sMap service, over the sMap Android and iOS SDKs.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package has no install lifecycle hook, its import entry only re-exports map APIs, and the native integration uses caller-supplied credentials for the map SDK. The platform build configuration and iOS framework-copy phase are consistent with the documented purpose.
Static reason
No blocking static signals were detected.
Trigger
Map behavior runs when an application uses the component; the iOS embedding helper runs when the consumer invokes it from Podfile post_install.
Impact
Expected map rendering and SDK integration; no unsolicited credential transfer or unrelated action was found in the inspected source.
Mechanism
The package forwards caller-provided map configuration to native SDKs and embeds the SDK framework into the app build.
AI rationale
The package has no install lifecycle hook, its import entry only re-exports map APIs, and the native integration uses caller-supplied credentials for the map SDK. The platform build configuration and iOS framework-copy phase are consistent with the documented purpose.
Network endpoints3
github.comjitpack.iotile.srsr.ca
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares no install, preinstall, or postinstall hook; its prepack script only copies the repository license.
- The main entry point only re-exports the map component, layer components, and types.
- Native code passes the supplied map key and token to the map SDK; token renewal is enabled only when the caller provides getToken.
- The documented iOS post-install helper adds a build phase to embed and sign the map engine framework from Xcode build products.
- Android declares the JitPack repository and the matching Goodneo sMap SDK artifact as its dependency.
Evidence against
Behavioral surface
Source & flagged code
8 flaggedios/smap_react_native.rbView file
•path = ios/smap_react_native.rb
kind = build_helper
sizeBytes = 4146
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
ios/smap_react_native.rbView on unpkg74# Adds the embed phase to every app target of the Podfile (once; kept up to date).
def self.post_install(installer)
inputs = ["${BUILT_PRODUCTS_DIR}/#{ENGINE}"]
outputs = ["${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}/#{ENGINE}"]
installer.aggregate_targets.each do |aggregate|
project = aggregate.user_project
next unless project
changed = false
aggregate.user_targets.each do |target|
next unless target.respond_to?(:product_type) && target.product_type == "com.apple.product-type.application"
phase = target.shell_script_build_pha
Low
Ai Review Evidence
The documented iOS post-install helper adds a build phase to embed and sign the map engine framework from Xcode build products.
ios/smap_react_native.rbView on unpkg · L7428# Copies the engine framework from the build products (where Xcode puts the package's binary framework) into the
# app's Frameworks folder and signs it as the app is signed.
EMBED_SCRIPT = <<~SH.freeze
set -e
src="${BUILT_PRODUCTS_DIR}/#{ENGINE}"
dst="${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}"
if [ ! -d "$src" ]; then
echo "error: #{ENGINE} not found in ${BUILT_PRODUCTS_DIR}; run pod install again"
exit 1
fi
mkdir -p "$dst"
rm -rf "$dst/#{ENGINE}"
cp -R "$src" "$dst/"
if [ "${CODE_SIGNING_ALLOWED}" = "YES" ] && [ -n "${EXPANDE
Findings
1 Medium8 Low
MediumShips Build Helperios/smap_react_native.rb
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/index.tsx
LowAi Review Evidenceios/RNSMapHost.swift
LowAi Review Evidenceandroid/src/main/java/ca/superroute/smap/reactnative/SMapReactView.kt
LowAi Review Evidenceios/smap_react_native.rb
LowAi Review Evidenceios/smap_react_native.rb
LowSuspicious Dependency Evidenceandroid/build.gradle
Affected versions and remediation
This report applies to @superrouteca/smap-react-native@1.0.5.
See all versions of @superrouteca/smap-react-native for other recorded verdicts.
- Review the evidence and your use of @superrouteca/smap-react-native@1.0.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.