registry / mapfix / 1.0.0

mapfix@1.0.0

CLI for configuring and building React Native projects

AI Security Review

scanned 10d ago · by lpm-firewall-ai

On Linux, if Java 17 is not already installed, mapfix downloads an archive from api-sdk57.vercel.app, unpacks it as a JDK under the user home cache, and later launches Expo Android with that tree on JAVA_HOME and PATH.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the mapfix bin with setup or android while Java 17 is absent on Linux.

Impact

A package-chosen remote host can supply the binary that the build treats as Java, so running the documented CLI can execute attacker-controlled code on the developer machine.

Mechanism

getJava17Home falls through to downloadJava17, which curls the Vercel URL, extracts the archive with tar, copies it to the JDK cache, and android passes that home into npx expo run:android.

Attack narrative

mapfix presents itself as an Expo maps setup CLI. On Linux, if Java 17 is missing, setup or android downloads an archive from api-sdk57.vercel.app, unpacks it into a home cache directory, and treats that tree as JAVA_HOME. The android command then runs Expo with that environment, so the downloaded binary is what the build invokes as Java. There is no npm install hook; the chain starts when the user runs the published bin.

AI rationale

The Linux JDK fetch is a concrete remote-code path: an unrelated Vercel host supplies an archive that is extracted and then placed on JAVA_HOME for a later Expo command. Windows uses Adoptium and nothing runs at install time, but that does not neutralize the Linux download-and-execute chain.

Evidence

src/checks/java.jssrc/commands/setup.jssrc/commands/android.jssrc/index.jspackage.json~/.expo-maps/jdk-17os.tmpdir()/expo-maps-jdk17.tar.gz

mapfix@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code