registry / expo-gaode-map / 2.2.41

expo-gaode-map@2.2.41

Expo Modules AMap (Gaode Map) stack for Expo/React Native: Config Plugin, New Architecture support, maps, location, search, offline maps, and react-native-amap3d migration guidance.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 47 file(s), 152 KB of source, external domains: docs.expo.dev, github.com, lbs.amap.com, tomwq.github.io

Source & flagged code

4 flagged

package.jsonView file

Lines 4-44json

4 "description": "Expo Modules AMap (Gaode Map) stack for Expo/React Native: Config Plugin, New Architecture support, maps, location, search, offline maps, and react-native-amap3d migration guidance.",

5 "main": "build/index.js",

6 "types": "build/index.d.ts",

7 "files": [

8 "build",

9 "android"

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/check-expo-modules.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/check-expo-modules.jsView file

6Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network L6: function resolveProjectRoot() { L7: return process.env.INIT_CWD || process.env.npm[redacted] || process.cwd(); L8: } ... L11: try { L12: require.resolve(`${pkgName}/package.json`, { paths: [projectRoot] }); L13: return true; ... L63: hasPodfile ? ' (then) cd ios && pod install' : null, L64: 'Docs: https://docs.expo.dev/bare/installing-expo-modules/', L65: ].filter(Boolean));

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/check-expo-modules.jsView on unpkg · L6

shared/cpp/tests/run.shView file

•path = shared/cpp/tests/run.sh kind = payload_in_excluded_dir sizeBytes = 258 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

shared/cpp/tests/run.shView on unpkg

•path = shared/cpp/tests/run.sh kind = build_helper sizeBytes = 258 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

shared/cpp/tests/run.shView on unpkg

Findings

3 High3 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighEntrypoint Build Divergencescripts/check-expo-modules.js

HighPayload In Excluded Dirshared/cpp/tests/run.sh

MediumEnvironment Vars

MediumShips Build Helpershared/cpp/tests/run.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

scripts/check-expo-modules.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

3const fs = require('node:fs');

4const path = require('node:path');

6function resolveProjectRoot() {

7 return process.env.INIT_CWD || process.env.npm_config_local_prefix || process.cwd();

10function hasPackage(pkgName, projectRoot) {

11 try {

12 require.resolve(`${pkgName}/package.json`, { paths: [projectRoot] });

13 return true;

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/check-expo-modules.jsView on unpkg · L6

14 } catch {

15 return false;

16 }

17}

19function printWarning(lines) {

20 const prefix = '[expo-gaode-map]';

21 console.warn(`${prefix} WARNING: Expo Modules infrastructure was not detected in this React Native project.`);

22 for (const line of lines) {

23 console.warn(`${prefix} ${line}`);

24 }

25}