react-native-alpr@0.4.1
On-device license plate recognition (ALPR/ANPR) for React Native and Expo
AI Security Review
scanned 4d ago · by lpm-firewall-aiClassify as suspicious telemetry: native build integrations send the consuming app ID to the vendor by default, with opt-out controls. The behavior is documented and the reports exclude plate and image data, so the evidence does not support blocking as malicious.
Static reason
No blocking static signals were detected.
Trigger
CocoaPods integration, Expo prebuild, and Android pre-build tasks; environment-variable opt-outs are available.
Impact
Reports can identify the consuming app or project to the vendor; source indicates these reports omit images and plate data.
Mechanism
The package reads configured app identifiers and includes them in POST reports to the vendor's build telemetry endpoint.
AI rationale
Classify as suspicious telemetry: native build integrations send the consuming app ID to the vendor by default, with opt-out controls. The behavior is documented and the reports exclude plate and image data, so the evidence does not support blocking as malicious.
Evidence
ReactNativeAlpr.podspecandroid/build.gradleapp.plugin.jsplugin/telemetry.js
Network endpoints1
alpr.parkr.app/t/build
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The CocoaPods integration reads application bundle IDs from the consuming Xcode project and posts them with build metadata to the vendor endpoint.
- Android build checks send the consuming app ID and build metadata, and are attached to pre-build tasks for debug and release variants.
- The Expo plugin sends app ID and build metadata during prebuild; build telemetry is on by default and has environment-variable opt-outs.
Evidence against
- The README discloses build-time telemetry and says reports contain app ID, platform, build type, versions, and license state; it documents environment-variable opt-outs.
- The documented reports exclude images and plate data, and the endpoint belongs to the package vendor.
- The package purpose is on-device license plate recognition, and its JS import entry exposes native scanning functions without sending data itself.
Behavioral surface
CryptoEnvironmentVarsNetwork
HighEntropyStrings
Source & flagged code
5 flaggedios/AlprKit.xcframework/ios-arm64_x86_64-simulator/AlprKit.framework/AlprKitView file
•path = ios/AlprKit.xcframework/ios-arm64_x86_64-simulator/AlprKit.framework/AlprKit
kind = native_binary
sizeBytes = 612264
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
ios/AlprKit.xcframework/ios-arm64_x86_64-simulator/AlprKit.framework/AlprKitView on unpkgios/AlprKit.xcframework/_CodeSignature/CodeSignatureView file
•path = ios/AlprKit.xcframework/_CodeSignature/CodeSignature
kind = high_entropy_blob
sizeBytes = 9087
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
ios/AlprKit.xcframework/_CodeSignature/CodeSignatureView on unpkgFindings
1 High7 Medium4 Low
HighShips High Entropy Blobios/AlprKit.xcframework/_CodeSignature/CodeSignature
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryios/AlprKit.xcframework/ios-arm64_x86_64-simulator/AlprKit.framework/AlprKit
MediumStructural Risk Force Deep Review
MediumAi Review EvidenceReactNativeAlpr.podspec
MediumAi Review EvidenceReactNativeAlpr.podspec
MediumAi Review Evidenceandroid/build.gradle
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to react-native-alpr@0.4.1.
See all versions of react-native-alpr for other recorded verdicts.
- Review the evidence and your use of react-native-alpr@0.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.