registry / @superrouteca/smap-react-native / 1.1.0

@superrouteca/smap-react-native@1.1.0

sMap for React Native: a map view for Superroute's sMap service, over the sMap Android and iOS SDKs, with standard style layers, basemap overrides, data formats and external layers.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The package metadata declares no install lifecycle hook, and its entry point exports map components and helpers. The flagged iOS script integrates the package's own SDK, while token handling is documented as app-supplied or provided through an explicit callback.

Static reason

No blocking static signals were detected.

Trigger

Consumers mount the map component or call its exposed methods; iOS build integration runs when configured in the app's Podfile.

Impact

Expected map rendering, SDK dependency resolution, and framework embedding; no unrelated credential collection or destructive behavior was found.

Mechanism

The iOS helper resolves the SDK from a local path or the package's GitHub release, then copies and signs the SDK's MapLibre framework during the app build.

AI rationale

Evidence

${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}/MapLibre.framework

Network endpoints2

github.com/Goodneo-Solutions/smap-sdk.gitjitpack.io

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Package scripts contain only test, typecheck, and a prepack command that copies the license; no install hook is declared.
The JavaScript entry point exports React Native map components and helpers.
The iOS helper fetches the matching sMap SDK release and embeds its MapLibre framework as part of app build integration.
The README describes map tokens as supplied by the app or its server and renewed through the opt-in getToken callback.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 47.1 KB of source

Source & flagged code

6 flagged

ios/smap_react_native.rbView file

•path = ios/smap_react_native.rb kind = build_helper sizeBytes = 4146 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

ios/smap_react_native.rbView on unpkg

70spm_dependency(spec, url: REMOTE, requirement: { kind: "exactVersion", version: version }, products: [PRODUCT]) end end # Adds the embed phase to every app target of the P

Low

Ai Review Evidence

The iOS helper fetches the matching sMap SDK release and embeds its MapLibre framework as part of app build integration.

ios/smap_react_native.rbView on unpkg · L70

40cp -R "$src" "$dst/" if [ "${CODE_SIGNING_ALLOWED}" = "YES" ] && [ -n "${EXPANDED_CODE_SIGN_IDENTITY}" ]; then codesign --force --sign "${EXPANDED_CODE_SIGN_IDENTITY}" --

Low

Ai Review Evidence

The iOS helper fetches the matching sMap SDK release and embeds its MapLibre framework as part of app build integration.

ios/smap_react_native.rb

Findings

1 Medium7 Low

MediumShips Build Helperios/smap_react_native.rb

LowScripts Present

LowHigh Entropy Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencesrc/index.tsx

LowAi Review Evidenceios/smap_react_native.rb

LowAi Review EvidenceREADME.md

Affected versions and remediation

This report applies to @superrouteca/smap-react-native@1.1.0.

See all versions of @superrouteca/smap-react-native for other recorded verdicts.

Review the evidence and your use of @superrouteca/smap-react-native@1.1.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 14:44:14.625Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @superrouteca/smap-react-native / 1.1.0

@superrouteca/smap-react-native@1.1.0

sMap for React Native: a map view for Superroute's sMap service, over the sMap Android and iOS SDKs, with standard style layers, basemap overrides, data formats and external layers.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

Consumers mount the map component or call its exposed methods; iOS build integration runs when configured in the app's Podfile.

Impact

Expected map rendering, SDK dependency resolution, and framework embedding; no unrelated credential collection or destructive behavior was found.

Mechanism

The iOS helper resolves the SDK from a local path or the package's GitHub release, then copies and signs the SDK's MapLibre framework during the app build.

AI rationale

Evidence

${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}/MapLibre.framework

Network endpoints2

github.com/Goodneo-Solutions/smap-sdk.gitjitpack.io

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Package scripts contain only test, typecheck, and a prepack command that copies the license; no install hook is declared.
The JavaScript entry point exports React Native map components and helpers.
The iOS helper fetches the matching sMap SDK release and embeds its MapLibre framework as part of app build integration.
The README describes map tokens as supplied by the app or its server and renewed through the opt-in getToken callback.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 47.1 KB of source

Source & flagged code

6 flagged

ios/smap_react_native.rbView file

•path = ios/smap_react_native.rb kind = build_helper sizeBytes = 4146 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

ios/smap_react_native.rbView on unpkg

70spm_dependency(spec, url: REMOTE, requirement: { kind: "exactVersion", version: version }, products: [PRODUCT]) end end # Adds the embed phase to every app target of the P

Low

Ai Review Evidence

The iOS helper fetches the matching sMap SDK release and embeds its MapLibre framework as part of app build integration.

ios/smap_react_native.rbView on unpkg · L70

40cp -R "$src" "$dst/" if [ "${CODE_SIGNING_ALLOWED}" = "YES" ] && [ -n "${EXPANDED_CODE_SIGN_IDENTITY}" ]; then codesign --force --sign "${EXPANDED_CODE_SIGN_IDENTITY}" --

Low

Ai Review Evidence

The iOS helper fetches the matching sMap SDK release and embeds its MapLibre framework as part of app build integration.

ios/smap_react_native.rb

Findings

1 Medium7 Low

MediumShips Build Helperios/smap_react_native.rb

LowScripts Present

LowHigh Entropy Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencesrc/index.tsx

LowAi Review Evidenceios/smap_react_native.rb

LowAi Review EvidenceREADME.md

Affected versions and remediation

This report applies to @superrouteca/smap-react-native@1.1.0.

See all versions of @superrouteca/smap-react-native for other recorded verdicts.

Review the evidence and your use of @superrouteca/smap-react-native@1.1.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 14:44:14.625Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.