registry / mapfix / 1.0.1

mapfix@1.0.1

⚠ Under review

CLI for configuring and building React Native projects

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 16.8 KB of source, external domains: api-sdk57.vercel.app, api.adoptium.net

Source & flagged code

6 flagged

src/checks/java.jsView file

Lines 1-23javascript

1const fs = require("node:fs");

2const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/checks/java.jsView on unpkg · L1

3const os = require("node:os");

4const { execSync } = require("node:child_process");

High

Child Process

Package source references child process execution.

src/checks/java.jsView on unpkg · L3

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/checks/java.jsView on unpkg · L3

6function getJava17Home() {

7 const javaHome = getSystemJavaHome();

9 if (javaHome) {

10 console.log("Java 17 encontrado!");

11 return javaHome;

12 }

14 const cachedJava = getCachedJava17();

16 if (cachedJava) {

17 console.log("JDK 17 encontrado no cache!");

18 return cachedJava;

19 }

21 console.log("Java 17 não encontrado.");

23 return downloadJava17();

Lines 110-150javascript

110

111 fs.rmSync(archivePath, {

112 force: true,

113 });

114

115 fs.mkdirSync(extractPath, {

116 recursive: true,

117 });

118

119 if (isWindows) {

120

•matchType = normalized_sha256 matchedPackage = mapfix@1.0.0 matchedPath = src/checks/java.js matchedIdentity = npm:bWFwZml4:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/checks/java.jsView on unpkg

src/expo/maps.jsView file

Lines 2-40javascript

2const fs = require("node:fs");

3const path = require("node:path");

5function hasReactNativeMaps() {

Source & flagged code

6 flagged · loading source

src/checks/java.jsView file

mapfix@1.0.1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code