registry / expo-gaode-map / 2.2.38

expo-gaode-map@2.2.38

Expo Modules AMap (Gaode Map) stack for Expo/React Native: Config Plugin, New Architecture support, maps, location, search, offline maps, and react-native-amap3d migration guidance.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 47 file(s), 151 KB of source, external domains: docs.expo.dev, github.com, lbs.amap.com, tomwq.github.io

Source & flagged code

4 flagged

package.jsonView file

Lines 4-44json

4 "description": "Expo Modules AMap (Gaode Map) stack for Expo/React Native: Config Plugin, New Architecture support, maps, location, search, offline maps, and react-native-amap3d migration guidance.",

5 "main": "build/index.js",

6 "types": "build/index.d.ts",

7 "files": [

8 "build",

9 "android",

10 "ios",

11 "shared",

12 "scripts",

13 "app.plugin.js",

14 "expo-module.config.json",

15 "plugin/build"

16 ],

17 "scripts": {

18 "build": "expo-module build && yarn build:plugin",

19 "build:plugin": "tsc --project plugin/tsconfig.json",

20 "clean": "expo-module clean && rm -rf plugin/build",

21 "lint": "expo-module lint",

22 "test": "npx jest --no-watchman --config jest.config.js --runInBand",

23 "prepare": "expo-module prepare && yarn build:plugin",

24 "postinstall": "node scripts/check-expo-modules.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

25 "prepublishOnly": "echo 'Skipping proofread check' && exit 0",

26 "expo-module": "expo-module",

27 "open:ios": "xed example/ios",

28 "open:android": "open -a \"Android Studio\" example/android",

29 "publish:next": "npm publish --tag next",

30 "publish:latest": "npm publish --tag latest"

31 },

32 "keywords": [

33 "react-native",

34 "expo",

35 "expo-gaode-map",

36 "ExpoGaodeMap",

37 "expo-amap",

38 "expo-map",

39 "react-native-amap",

40 "react-native-amap3d",

41 "react-native-amap3d-alternative",

42 "react-native-gaode-map",

43 "rn-amap",

44 "rn-gaode-map",

scripts/check-expo-modules.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

3const fs = require('node:fs');

4const path = require('node:path');

6function resolveProjectRoot() {

7 return process.env.

shared/cpp/tests/run.shView file

•path = shared/cpp/tests/run.sh kind = payload_in_excluded_dir sizeBytes = 258 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

shared/cpp/tests/run.shView on unpkg

•path = shared/cpp/tests/run.sh kind = build_helper sizeBytes = 258 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

shared/cpp/tests/run.shView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/check-expo-modules.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/check-expo-modules.jsView file

6Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network L6: function resolveProjectRoot() { L7: return process.env.INIT_CWD || process.env.npm[redacted] || process.cwd(); L8: } ... L11: try { L12: require.resolve(`${pkgName}/package.json`, { paths: [projectRoot] }); L13: return true; ... L63: hasPodfile ? ' (then) cd ios && pod install' : null, L64: 'Docs: https://docs.expo.dev/bare/installing-expo-modules/', L65: ].filter(Boolean));

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/check-expo-modules.jsView on unpkg · L6

shared/cpp/tests/run.shView file

•path = shared/cpp/tests/run.sh kind = payload_in_excluded_dir sizeBytes = 258 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

shared/cpp/tests/run.shView on unpkg

•path = shared/cpp/tests/run.sh kind = build_helper sizeBytes = 258 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

shared/cpp/tests/run.shView on unpkg

Findings

3 High3 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighEntrypoint Build Divergencescripts/check-expo-modules.js

HighPayload In Excluded Dirshared/cpp/tests/run.sh

MediumEnvironment Vars

MediumShips Build Helpershared/cpp/tests/run.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 4-44json

5 "main": "build/index.js",

6 "types": "build/index.d.ts",

7 "files": [

8 "build",

9 "android",

10 "ios",

11 "shared",

12 "scripts",

13 "app.plugin.js",

14 "expo-module.config.json",

15 "plugin/build"

16 ],

17 "scripts": {

18 "build": "expo-module build && yarn build:plugin",

19 "build:plugin": "tsc --project plugin/tsconfig.json",

20 "clean": "expo-module clean && rm -rf plugin/build",

21 "lint": "expo-module lint",

22 "test": "npx jest --no-watchman --config jest.config.js --runInBand",

23 "prepare": "expo-module prepare && yarn build:plugin",

24 "postinstall": "node scripts/check-expo-modules.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

25 "prepublishOnly": "echo 'Skipping proofread check' && exit 0",

26 "expo-module": "expo-module",

27 "open:ios": "xed example/ios",

28 "open:android": "open -a \"Android Studio\" example/android",

29 "publish:next": "npm publish --tag next",

30 "publish:latest": "npm publish --tag latest"

31 },

32 "keywords": [

33 "react-native",

34 "expo",

35 "expo-gaode-map",

36 "ExpoGaodeMap",

37 "expo-amap",

38 "expo-map",

39 "react-native-amap",

40 "react-native-amap3d",

41 "react-native-amap3d-alternative",

42 "react-native-gaode-map",

43 "rn-amap",

44 "rn-gaode-map",

scripts/check-expo-modules.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

3const fs = require('node:fs');

4const path = require('node:path');

6function resolveProjectRoot() {

7 return process.env.

shared/cpp/tests/run.shView file

•path = shared/cpp/tests/run.sh kind = payload_in_excluded_dir sizeBytes = 258 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

shared/cpp/tests/run.shView on unpkg

•path = shared/cpp/tests/run.sh kind = build_helper sizeBytes = 258 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

shared/cpp/tests/run.shView on unpkg