registry / @superrouteca/smap-react-native / 1.1.2

@superrouteca/smap-react-native@1.1.2

sMap for React Native: a map view for Superroute's sMap service, over the sMap Android and iOS SDKs, with standard style layers, basemap overrides, data formats and external layers.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The package has no install lifecycle hook, and its entry point exposes map functionality consistent with its stated purpose. The flagged native helper supports SDK integration, while offline downloads require an explicit API call.

Static reason

No blocking static signals were detected.

Trigger

Map rendering and offline operations run when an app uses the exported components or calls the corresponding API.

Impact

Expected map rendering and user-requested offline map downloads; no unrelated credential handling or harmful automatic action was found.

Mechanism

The native modules pass supplied map configuration and credentials to the sMap SDK; the iOS CocoaPods helper configures embedding of the map engine during the documented build integration.

AI rationale

Network endpoints3

github.comtile.srsr.cajitpack.io

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest points to a React Native map entry point and declares no install, preinstall, or postinstall hook.
The entry point exports the map components and an offline-region API consistent with the package description.
Offline downloads are an explicit API operation, documented as downloading map regions using an authorized token or a key with offline access enabled.
The iOS helper pins the matching sMap SDK release and adds a build phase to embed its map engine framework.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 53.9 KB of source

Source & flagged code

6 flagged

ios/smap_react_native.rbView file

•path = ios/smap_react_native.rb kind = build_helper sizeBytes = 4146 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

ios/smap_react_native.rbView on unpkg

70spm_dependency(spec, url: REMOTE, requirement: { kind: "exactVersion", version: version }, products: [PRODUCT]) end end # Adds the embed phase to every app target of the Podfile (once; kept up to date). def self.post_install(installer) inputs = ["${BUILT_PRODUCTS_DIR}/#{ENGINE}"] outputs = ["${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}/#{ENGINE}"] installer.aggregate_targets.each do |aggregate| project = aggregate.user_project next unless project changed = false aggregate.user_targets.each do |target|

Low

Ai Review Evidence

The iOS helper pins the matching sMap SDK release and adds a build phase to embed its map engine framework.

ios/smap_react_native.rbView on unpkg · L70

package.jsonView file

Findings

2 Medium6 Low

MediumShips Build Helperios/smap_react_native.rb

MediumStripped Provenance Metadatasrc/offline.ts

LowScripts Present

LowHigh Entropy Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencesrc/index.tsx

LowAi Review Evidenceios/smap_react_native.rb

Affected versions and remediation

This report applies to @superrouteca/smap-react-native@1.1.2.

See all versions of @superrouteca/smap-react-native for other recorded verdicts.

Review the evidence and your use of @superrouteca/smap-react-native@1.1.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 14:44:18.334Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @superrouteca/smap-react-native / 1.1.2

@superrouteca/smap-react-native@1.1.2

sMap for React Native: a map view for Superroute's sMap service, over the sMap Android and iOS SDKs, with standard style layers, basemap overrides, data formats and external layers.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

Map rendering and offline operations run when an app uses the exported components or calls the corresponding API.

Impact

Expected map rendering and user-requested offline map downloads; no unrelated credential handling or harmful automatic action was found.

Mechanism

The native modules pass supplied map configuration and credentials to the sMap SDK; the iOS CocoaPods helper configures embedding of the map engine during the documented build integration.

AI rationale

Network endpoints3

github.comtile.srsr.cajitpack.io

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest points to a React Native map entry point and declares no install, preinstall, or postinstall hook.
The entry point exports the map components and an offline-region API consistent with the package description.
Offline downloads are an explicit API operation, documented as downloading map regions using an authorized token or a key with offline access enabled.
The iOS helper pins the matching sMap SDK release and adds a build phase to embed its map engine framework.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 53.9 KB of source

Source & flagged code

6 flagged

ios/smap_react_native.rbView file

•path = ios/smap_react_native.rb kind = build_helper sizeBytes = 4146 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

ios/smap_react_native.rbView on unpkg

Low

Ai Review Evidence

The iOS helper pins the matching sMap SDK release and adds a build phase to embed its map engine framework.

ios/smap_react_native.rbView on unpkg · L70

package.jsonView file

Findings

2 Medium6 Low

MediumShips Build Helperios/smap_react_native.rb

MediumStripped Provenance Metadatasrc/offline.ts

LowScripts Present

LowHigh Entropy Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencesrc/index.tsx

LowAi Review Evidenceios/smap_react_native.rb

Affected versions and remediation

This report applies to @superrouteca/smap-react-native@1.1.2.

See all versions of @superrouteca/smap-react-native for other recorded verdicts.

Review the evidence and your use of @superrouteca/smap-react-native@1.1.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 14:44:18.334Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.