registry / @superrouteca/smap-react-native / 1.1.6
@superrouteca/smap-react-native@1.1.6
sMap for React Native: a map view for Superroute's sMap service, over the sMap Android and iOS SDKs, with standard style layers, basemap overrides, data formats and external layers.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package contains no install lifecycle hooks or suspicious import-time actions. Its network transport sends caller-provided credentials to the documented Superroute API, while the native build helpers integrate the package’s map SDK.
Static reason
No blocking static signals were detected.
Trigger
The plan transport runs when the app uses the plan editor; native dependency and framework setup occurs during the documented build process.
Impact
Expected map rendering, plan editing, and native SDK integration; no unrelated data access or harmful side effect was found.
Mechanism
The editor sends caller-provided credentials to the configured Open Platform endpoint. Native build configuration retrieves the sMap SDK and embeds its framework.
AI rationale
The package contains no install lifecycle hooks or suspicious import-time actions. Its network transport sends caller-provided credentials to the documented Superroute API, while the native build helpers integrate the package’s map SDK.
Evidence
ios/smap_react_native.rbSMapReactNative.podspecandroid/build.gradlesrc/plan/smap-plan.js
Network endpoints3
open.superroute.cagithub.com/Goodneo-Solutions/smap-sdk.gitjitpack.io
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install lifecycle hooks; its scripts are test, typecheck, and prepack.
- The plan editor’s default endpoint is the documented Open Platform at https://open.superroute.ca, with a configurable base URL.
- The plan editor adds caller-provided credential headers to requests made by its transport.
- The iOS helper embeds and signs the SDK framework in app build targets as part of the documented CocoaPods setup.
- The Android build configuration retrieves the package’s documented sMap SDK dependency through JitPack.
Evidence against
- The package includes network transport and native build helpers, but their behavior matches its stated map and plan-editing purpose.
- The plan editor can price a plan when the caller supplies one during editor creation; this is part of the documented API behavior.
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedios/smap_react_native.rbView file
•path = ios/smap_react_native.rb
kind = build_helper
sizeBytes = 4146
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
ios/smap_react_native.rbView on unpkg28# Copies the engine framework from the build products (where Xcode puts the package's binary framework) into the
# app's Frameworks folder and signs it as the app is signed.
EMBED_SCRIPT = <<~SH.freeze
set -e
src="${BUILT_PRODUCTS_DIR}/#{ENGINE}"
dst="${TARGET_BUILD_DIR}/${FRAMEWORKS_FOLDER_PATH}"
Low
Ai Review Evidence
The iOS helper embeds and signs the SDK framework in app build targets as part of the documented CocoaPods setup.
ios/smap_react_native.rbView on unpkg · L28package.jsonView file
29"scripts": {
"test": "jest",
"typecheck": "tsc --noEmit",
"prepack": "cp ../LICENSE LICENSE"
},
"peerDependencies": {
"react": ">=18",
"react-native": ">=
Findings
2 Medium8 Low
MediumNetwork
MediumShips Build Helperios/smap_react_native.rb
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/plan/smap-plan.js
LowAi Review Evidencesrc/plan/smap-plan.js
LowAi Review Evidenceios/smap_react_native.rb
LowSuspicious Dependency Evidenceandroid/build.gradle
Affected versions and remediation
This report applies to @superrouteca/smap-react-native@1.1.6.
See all versions of @superrouteca/smap-react-native for other recorded verdicts.
- Review the evidence and your use of @superrouteca/smap-react-native@1.1.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.