react-native-alpr@0.4.0
On-device license plate recognition (ALPR/ANPR) for React Native and Expo
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package performs disclosed, default-on telemetry during Expo prebuild, Gradle builds, and CocoaPods setup, sending app identifiers and build metadata to its vendor. No credential or end-user data collection was identified, so this warrants a telemetry warning rather than a publish block.
Static reason
No blocking static signals were detected.
Trigger
Expo prebuild, Gradle build checks, or CocoaPods podspec evaluation; environment variables can disable it.
Impact
Shares project identifiers and build details with the vendor without an explicit per-build prompt; the README documents the collection and opt-out.
Mechanism
Posts build metadata, including the app ID, to the package vendor's telemetry endpoint.
AI rationale
The package performs disclosed, default-on telemetry during Expo prebuild, Gradle builds, and CocoaPods setup, sending app identifiers and build metadata to its vendor. No credential or end-user data collection was identified, so this warrants a telemetry warning rather than a publish block.
Evidence
app.plugin.jsplugin/telemetry.jsandroid/build.gradleReactNativeAlpr.podspecREADME.md
Network endpoints1
alpr.parkr.app/t/build
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Expo prebuild sends app ID, platform, build profile, framework versions, license state and EAS status.
- Build telemetry posts to alpr.parkr.app and is enabled unless an environment variable opts out.
- Gradle build checks send app ID, build type, package version, CI flag and license state.
- CocoaPods setup reads app bundle IDs and posts them with build metadata.
- The README discloses build-time and runtime telemetry and documents opt-outs.
Evidence against
- The JavaScript entry points primarily expose the native ALPR module; no import-time telemetry call was found.
- The build telemetry payloads do not include license keys, images, plate readings or user credentials.
- The package describes on-device recognition and says runtime telemetry can be disabled.
Behavioral surface
CryptoEnvironmentVarsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedios/AlprKit.xcframework/ios-arm64_x86_64-simulator/AlprKit.framework/AlprKitView file
•path = ios/AlprKit.xcframework/ios-arm64_x86_64-simulator/AlprKit.framework/AlprKit
kind = native_binary
sizeBytes = 612264
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
ios/AlprKit.xcframework/ios-arm64_x86_64-simulator/AlprKit.framework/AlprKitView on unpkgandroid/maven/app/parkr/alpr/0.4.0/alpr-0.4.0.aarView file
•path = android/maven/app/parkr/alpr/0.4.0/alpr-0.4.0.aar
kind = compressed_blob
sizeBytes = 7585033
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
android/maven/app/parkr/alpr/0.4.0/alpr-0.4.0.aarView on unpkgFindings
1 High6 Medium5 Low
HighShips High Entropy Blobios/AlprKit.xcframework/_CodeSignature/CodeSignature
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryios/AlprKit.xcframework/ios-arm64_x86_64-simulator/AlprKit.framework/AlprKit
MediumShips Compressed Blobandroid/maven/app/parkr/alpr/0.4.0/alpr-0.4.0.aar
MediumStructural Risk Force Deep Review
MediumAi Review Evidenceapp.plugin.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectionandroid/maven/app/parkr/alpr/0.4.0/alpr-0.4.0.aar
Affected versions and remediation
This report applies to react-native-alpr@0.4.0.
See all versions of react-native-alpr for other recorded verdicts.
- Review the evidence and your use of react-native-alpr@0.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.