registry / @utexo/rgb-sdk-rn / 1.0.0-beta.21

@utexo/rgb-sdk-rn@1.0.0-beta.21

React Native SDK for Bitcoin RGB Protocol

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 49 file(s), 276 KB of source, external domains: github.com, lsp-signet.utexo.com

Source & flagged code

2 flagged

package.jsonView file

Lines 29-69json

29 "!ios/build",

30 "!ios/rgb_libFFI.xcframework",

31 "!ios/RGBLightningNode.xcframework",

32 "!ios/RGBLightningNodeFFI.h",

33 "!ios/RGBLightningNodeFFI.modulemap",

34 "!ios/RGBLightningNode.swift",

35 "!android/build",

36 "!android/gradle",

37 "!android/gradlew",

38 "!android/gradlew.bat",

39 "!android/local.properties",

40 "!**/__tests__",

41 "!**/__fixtures__",

42 "!**/__mocks__",

43 "!**/.*"

44 ],

45 "scripts": {

46 "dev": "tsc -w",

47 "clean": "del-cli android/build ios/build lib",

48 "prepare": "bob build",

49 "postinstall": "node scripts/download-rln-bindings.js && node scripts/setup-rln-bindings.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 "typecheck": "tsc",

51 "codegen": "mkdir -p android/build/generated/source/codegen && node node_modules/@react-native/codegen/lib/cli/combine/combine-js-to-schema-cli.js android/build/generated/source/codegen/schema.json src/binding/NativeRgb.ts && node node_modules/@react-native/codegen/lib/cli/generators/generate-all.js android/build/generated/source/codegen/schema.json RgbSpec android/build/generated/source/codegen com.rgbsdkrn",

52 "build": "bob build",

53 "build:watch": "tsc -w",

54 "prettier": "prettier --write \"**/*.{js,ts,tsx}\"",

55 "lint": "eslint \"**/*.{js,ts,tsx}\"",

56 "version:patch": "npm version patch && git push && git push --tags && npm publish --access public",

57 "version:minor": "npm version minor && git push && git push --tags && npm publish --access public",

58 "version:major": "npm version major && git push && git push --tags && npm publish --access public"

59 },

60 "repository": {

61 "type": "git",

62 "url": "https://github.com/UTEXO-Protocol/rgb-sdk-rn.git"

63 },

64 "keywords": [

65 "rgb",

66 "rgb-protocol",

67 "bitcoin",

68 "sdk",

69 "taproot",

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/download-rln-bindings.js && node scripts/setup-rln-bindings.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/download-rln-bindings.js && node scripts/setup-rln-bindings.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

package.jsonView file

Lines 29-69json

29 "!ios/build",

30 "!ios/rgb_libFFI.xcframework",

31 "!ios/RGBLightningNode.xcframework",

32 "!ios/RGBLightningNodeFFI.h",

33 "!ios/RGBLightningNodeFFI.modulemap",

34 "!ios/RGBLightningNode.swift",

35 "!android/build",

36 "!android/gradle",

37 "!android/gradlew",

38 "!android/gradlew.bat",

39 "!android/local.properties",

40 "!**/__tests__",

41 "!**/__fixtures__",

42 "!**/__mocks__",

43 "!**/.*"

44 ],

45 "scripts": {

46 "dev": "tsc -w",

47 "clean": "del-cli android/build ios/build lib",

48 "prepare": "bob build",

49 "postinstall": "node scripts/download-rln-bindings.js && node scripts/setup-rln-bindings.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 "typecheck": "tsc",

52 "build": "bob build",

53 "build:watch": "tsc -w",

54 "prettier": "prettier --write \"**/*.{js,ts,tsx}\"",

55 "lint": "eslint \"**/*.{js,ts,tsx}\"",

56 "version:patch": "npm version patch && git push && git push --tags && npm publish --access public",

57 "version:minor": "npm version minor && git push && git push --tags && npm publish --access public",

58 "version:major": "npm version major && git push && git push --tags && npm publish --access public"

59 },

60 "repository": {

61 "type": "git",

62 "url": "https://github.com/UTEXO-Protocol/rgb-sdk-rn.git"

63 },

64 "keywords": [

65 "rgb",

66 "rgb-protocol",

67 "bitcoin",

68 "sdk",

69 "taproot",