halo-sdk-react-native
React Native plugin for Halo SDK
This report shows the evidence for halo-sdk-react-native@1.0.7, the only known version.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe bundled Sonic AAR has analytics enabled and specifies a Mixpanel tracking endpoint, but the package documentation does not disclose this telemetry. The feature is gated behind an explicit animation option and an approved transaction, and the available AAR analysis does not reveal what is reported, so this warrants a warning rather than a block.
Decision evidence
public snapshot- The bundled Sonic AAR config enables analytics and names https://api.mixpanel.com/track?verbose=1.
- The plugin launches the Sonic animation only after an approved transaction when scheme animations are enabled.
- Scheme animations default to false, and the README does not disclose analytics.
- The manifest has no install lifecycle hooks; its only script is a TypeScript build.
- The animation path requires explicit SDK initialization, opting into animations, and an approved transaction.
- The analytics payload and actual Mixpanel reporting behavior could not be established from the available AAR analysis.
Source & flagged code
7 flaggedPackage ships high-entropy non-source blobs.
android/libs/sonic-sdk-release-1.5.0.aarView on unpkgPackage ships compressed or archive-like blobs.
android/libs/sonic-sdk-release-1.5.0.aarView on unpkgPackage ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
android/libs/sonic-sdk-release-1.5.0.aarView on unpkgFindings
Affected versions and remediation
This report applies to halo-sdk-react-native@1.0.7.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of halo-sdk-react-native@1.0.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.