halo-sdk-react-native@1.0.7
React Native plugin for Halo SDK
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe bundled Sonic AAR has analytics enabled and specifies a Mixpanel tracking endpoint, but the package documentation does not disclose this telemetry. The feature is gated behind an explicit animation option and an approved transaction, and the available AAR analysis does not reveal what is reported, so this warrants a warning rather than a block.
Static reason
No blocking static signals were detected.
Trigger
An app initializes the SDK with scheme animations enabled and completes an approved transaction that launches the Sonic animation.
Impact
Runtime telemetry may be sent without disclosure in the package documentation; the data collected is unknown.
Mechanism
The AAR's version configuration sets analytics to enabled and specifies the Mixpanel tracking URL.
AI rationale
The bundled Sonic AAR has analytics enabled and specifies a Mixpanel tracking endpoint, but the package documentation does not disclose this telemetry. The feature is gated behind an explicit animation option and an approved transaction, and the available AAR analysis does not reveal what is reported, so this warrants a warning rather than a block.
Evidence
.lpm-inspection-YacICq/0-1c7d7b3b0724.txtandroid/src/main/kotlin/za/co/synthesis/halo/sdkreactnativeplugin/HaloCallbacks.ktdist/HaloSdk.js
Network endpoints1
api.mixpanel.com/track?verbose=1
Decision evidence
public snapshotAI called this Suspicious at 81.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The bundled Sonic AAR config enables analytics and names https://api.mixpanel.com/track?verbose=1.
- The plugin launches the Sonic animation only after an approved transaction when scheme animations are enabled.
- Scheme animations default to false, and the README does not disclose analytics.
Evidence against
- The manifest has no install lifecycle hooks; its only script is a TypeScript build.
- The animation path requires explicit SDK initialization, opting into animations, and an approved transaction.
- The analytics payload and actual Mixpanel reporting behavior could not be established from the available AAR analysis.
Behavioral surface
Source & flagged code
7 flaggedandroid/libs/sonic-sdk-release-1.5.0.aarView file
•path = android/libs/sonic-sdk-release-1.5.0.aar
kind = high_entropy_blob
sizeBytes = 607690
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
android/libs/sonic-sdk-release-1.5.0.aarView on unpkg•path = android/libs/sonic-sdk-release-1.5.0.aar
kind = compressed_blob
sizeBytes = 607690
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
android/libs/sonic-sdk-release-1.5.0.aarView on unpkg•path = android/libs/sonic-sdk-release-1.5.0.aar
kind = nested_archive_needs_inspection
sizeBytes = 607690
magicHex = [redacted]
Low
Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
android/libs/sonic-sdk-release-1.5.0.aarView on unpkgFindings
2 High5 Medium2 Low
HighShips High Entropy Blobandroid/libs/sonic-sdk-release-1.5.0.aar
HighSemantic Analysis Limiteddist/HaloSdk.js#virtual:normalized:round1
MediumShips Compressed Blobandroid/libs/sonic-sdk-release-1.5.0.aar
MediumStructural Risk Force Deep Review
MediumAi Review Evidence.lpm-inspection-YacICq/0-1c7d7b3b0724.txt
MediumAi Review Evidenceandroid/src/main/kotlin/za/co/synthesis/halo/sdkreactnativeplugin/HaloCallbacks.kt
MediumAi Review Evidencedist/HaloSdk.js
LowScripts Present
LowNested Archive Needs Inspectionandroid/libs/sonic-sdk-release-1.5.0.aar
Affected versions and remediation
This report applies to halo-sdk-react-native@1.0.7.
See all versions of halo-sdk-react-native for other recorded verdicts.
- Review the evidence and your use of halo-sdk-react-native@1.0.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.