registry / @vectalon-dev/rn / 0.19.2
@vectalon-dev/rn@0.19.2
The adaptive AI harness for React Native — project-aware SDLC intelligence for any agent
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged credential and network code implements provider-specific Git operations, with push and pull request actions disabled by default. No install-time behavior or unrelated credential destination was established.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user invokes a Git integration action; remote writes require `--push` or `config.git.push=true`.
Impact
No unrelated credential disclosure or unsolicited account action was established.
Mechanism
The adapter uses provider-specific credentials for requests to that provider’s API.
AI rationale
The flagged credential and network code implements provider-specific Git operations, with push and pull request actions disabled by default. No install-time behavior or unrelated credential destination was established.
Evidence
dist/adapters/git.js
Network endpoints4
api.github.comdev.azure.comgitlab.comapi.bitbucket.org
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to a package library and CLI, with ordinary build, test, lint, and release scripts; no install lifecycle hook is declared.
- Git operations that push or create pull requests are disabled by default and require `--push` or configuration to enable.
- Provider credentials are read for matching provider operations and sent to that provider’s API to comment on a pull request.
Evidence against
- The scanner flags credential handling and network requests, but the reviewed flows target the corresponding Git hosting service and support the package’s Git integration.
- The doctor command and download-and-run hints did not establish an automatic or unrelated attack in the reviewed source.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsTelemetry
Source & flagged code
8 flaggedbench/references/rn-05-form-validation.jsonView file
10patternName = generic_password
severity = medium
line = 10
Medium
Secret Pattern
Package contains a possible secret pattern.
bench/references/rn-05-form-validation.jsonView on unpkg · L10dist/utils/dynamicImport.jsView file
12*/
L13: exports.dynamicImport = new Function('modulePath', 'return import(modulePath)');
L14: //# sourceMappingURL=dynamicImport.js.map
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/utils/dynamicImport.jsView on unpkg · L12bin/rn-vectalon.jsView file
Findings
1 Critical4 High5 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/cli/commands/doctor.js
HighCredential Exfiltrationdist/adapters/git.js
HighSandbox Evasion Gated Capabilitydist/adapters/git.js
HighTrigger Reachable Credential Exfiltrationdist/adapters/git.js
HighSemantic Analysis Limiteddist/arch/index.js#virtual:normalized:round1
MediumSecret Patternbench/references/rn-05-form-validation.json
MediumDynamic Requirebin/rn-vectalon.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/utils/dynamicImport.js
Low
Affected versions and remediation
This report applies to @vectalon-dev/rn@0.19.2.
See all versions of @vectalon-dev/rn for other recorded verdicts.
- Review the evidence and your use of @vectalon-dev/rn@0.19.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.