registry  /  expo-device-hub  /  0.1.1

expo-device-hub@0.1.1

Expo DevTools plugin for managing iOS simulators and Android emulators.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 21 file(s), 1.95 MB of source, external domains: 127.0.0.1, github.com, react.dev, serve-sim.local, www.apple.com, www.w3.org

Source & flagged code

8 flagged · loading source
dist/server/index.mjsView file
4// ../@expo/hub-android-utils/dist/emulator.js L5: import { spawn } from "node:child_process"; L6: function emulatorSerial(port) {
High
Child Process

Package source references child process execution.

dist/server/index.mjsView on unpkg · L4
4Cross-file remote execution chain: dist/server/index.mjs spawns vendor/serve-sim/dist/serve-sim.js; helper contains network access plus dynamic code execution. L4: // ../@expo/hub-android-utils/dist/emulator.js L5: import { spawn } from "node:child_process"; L6: function emulatorSerial(port) { ... L87: try { L88: const emulator = resolveEmulatorPath(process.env, homedir()); L89: const child = spawnEmulator(emulator, options); ... L145: try { L146: const { stdout } = await execFileAsync(avdmanagerPath2, [ L147: "list", ... L595: try { L596: return JSON.parse(json); L597: } catch (error) {
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/server/index.mjsView on unpkg · L4
dist/client/_expo/static/js/web/index-13af7f69e15c1e50e69a1f011ced02ea.jsView file
20__d(function(g,r,i,a,m,e,d){"use strict";Object.defineProperty(e,'__esModule',{value:!0}),e.fetchThenEvalAsync=function(o,{scriptType:c,nonce:s,crossOrigin:u}={}){if('undefined'==t... L21: __d(function(g,r,i,a,m,e,d){"use strict";Object.defineProperty(e,'__esModule',{value:!0}),e.fetchThenEvalAsync=fetchThenEvalAsync,r(d[0]);var _fetchAsync=r(d[1]);function fetchThen... L22: __d(function(g,r,i,a,m,e,d){"use strict";Object.defineProperty(e,'__esModule',{value:!0}),Object.defineProperty(e,"MetroServerError",{enumerable:!0,get:function(){return t}});class...
High
Eval

Package source references dynamic code evaluation.

dist/client/_expo/static/js/web/index-13af7f69e15c1e50e69a1f011ced02ea.jsView on unpkg · L20
2!(function(e){'use strict';e[`${__METRO_GLOBAL_PREFIX__}__d`]||(e.__r=i,e[`${__METRO_GLOBAL_PREFIX__}__d`]=function(e,n,o){if(t.has(n))return;const i={dependencyMap:o,factory:e,has... L3: !(function(e){e.$$require_external="undefined"!=typeof require?e=>require(e):()=>null})('undefined'!=typeof globalThis?globalThis:'undefined'!=typeof global?global:'undefined'!=typ... L4: 'undefined'!=typeof globalThis?globalThis:'undefined'!=typeof global?global:'undefined'!=typeof window&&window;
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/client/_expo/static/js/web/index-13af7f69e15c1e50e69a1f011ced02ea.jsView on unpkg · L2
vendor/serve-sim/dist/serve-sim.jsView file
26Expecting one of '${e.join("', '")}'`);let A=`${_}Help`;return this.on(A,(S)=>{let s;if(typeof C==="function")s=C({error:S.error,command:S.command});else s=C;if(s)S.write(`${s} L27: `)}),this}_outputHelpIfRequested(_){let C=this._getHelpOption();if(C&&_.find((A)=>C.is(A)))this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)")}}function ZA(_){... L28: serve-sim ui <option> [-d udid] Print the current value ... L41: reduce-transparency on | off L42: voiceover on | off`});var PS=j((A1,mS)=>{var q_=1000,U_=q_*60,I_=U_*60,v_=I_*24,ti=v_*7,ii=v_*365.25;mS.exports=function(_,C){C=C||{};var e=typeof _;if(e==="string"&&_.l... L43: `).join(`
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

vendor/serve-sim/dist/serve-sim.jsView on unpkg · L26
13(Did you mean one of ${A.join(", ")}?)`;if(A.length===1)return` L14: (Did you mean ${A[0]}?)`;return""}mB.suggestSimilar=GB});var jA=j((xB)=>{var KB=R_("node:events").EventEmitter,te=R_("node:child_process"),y_=R_("node:path"),cC=R_("node:fs"),m=R_(... L15: - specify the name in Command constructor or using .name()`);if(C=C||{},C.isDefault)this._defaultCommandName=_._name;if(C.noHelp||C.hidden)_._hidden=!0;return this._registerCommand... ... L26: Expecting one of '${e.join("', '")}'`);let A=`${_}Help`;return this.on(A,(S)=>{let s;if(typeof C==="function")s=C({error:S.error,command:S.command});else s=C;if(s)S.write(`${s} L27: `)}),this}_outputHelpIfRequested(_){let C=this._getHelpOption();if(C&&_.find((A)=>C.is(A)))this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)")}}function ZA(_){... L28: serve-sim ui <option> [-d udid] Print the current value
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

vendor/serve-sim/dist/serve-sim.jsView on unpkg · L13
1#!/usr/bin/env node L2: import{createRequire as TB}from"node:module";var nB=Object.create;var{getPrototypeOf:cB,defineProperty:ee,getOwnPropertyNames:bB}=Object;var aB=Object.prototype.hasOwnProperty;var ... L3: `)}displayWidth(_){return UA(_).length}styleTitle(_){return _}styleUsage(_){return _.split(" ").map((C)=>{if(C==="[options]")return this.styleOptionText(C);if(C==="[command]")retur... ... L13: (Did you mean one of ${A.join(", ")}?)`;if(A.length===1)return` L14: (Did you mean ${A[0]}?)`;return""}mB.suggestSimilar=GB});var jA=j((xB)=>{var KB=R_("node:events").EventEmitter,te=R_("node:child_process"),y_=R_("node:path"),cC=R_("node:fs"),m=R_(... L15: - specify the name in Command constructor or using .name()`);if(C=C||{},C.isDefault)this._defaultCommandName=_._name;if(C.noHelp||C.hidden)_._hidden=!0;return this._registerCommand... ... L26: Expecting one of '${e.join("', '")}'`);let A=`${_}Help`;return this.on(A,(S)=>{let s;if(typeof C==="function")s=C({error:S.error,command:S.command});else s=C;if(s)S.write(`${s} L27: `)}),this}_outputHelpIfRequested(_){let C=this._getHelpOption();if(C&&_.find((A)=>C.is(A)))this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHe
Low
Weak Crypto

Package source references weak cryptographic algorithms.

vendor/serve-sim/dist/serve-sim.jsView on unpkg · L1
vendor/serve-sim/bin/serve-sim-binView file
•path = vendor/serve-sim/bin/serve-sim-bin kind = native_binary sizeBytes = 1681760 magicHex = [redacted]
Medium
Ships Native Binary

Package ships native binary artifacts.

vendor/serve-sim/bin/serve-sim-binView on unpkg

Findings

6 High5 Medium6 Low
HighChild Processdist/server/index.mjs
HighShell
HighEvaldist/client/_expo/static/js/web/index-13af7f69e15c1e50e69a1f011ced02ea.js
HighSame File Env Network Executionvendor/serve-sim/dist/serve-sim.js
HighCommand Output Exfiltrationvendor/serve-sim/dist/serve-sim.js
HighCross File Remote Execution Contextdist/server/index.mjs
MediumDynamic Requiredist/client/_expo/static/js/web/index-13af7f69e15c1e50e69a1f011ced02ea.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryvendor/serve-sim/bin/serve-sim-bin
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptovendor/serve-sim/dist/serve-sim.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings