react-native-alpr@0.4.2
On-device license plate recognition (ALPR/ANPR) for React Native and Expo
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package’s build integrations send app identifiers to the vendor’s service by default, which is identifying project data under the telemetry review rules. The behavior is disclosed and can be disabled, so this warrants a warning rather than a malicious verdict.
Static reason
No blocking static signals were detected.
Trigger
Expo prebuild, CocoaPods installation, or an Android Gradle build task when telemetry opt-outs are unset.
Impact
The vendor receives identifying information about the application project without an explicit per-build consent action.
Mechanism
Build scripts collect the app identifier and send it with platform, build type, SDK version, CI status, framework, and license state to the vendor’s telemetry endpoint.
AI rationale
The package’s build integrations send app identifiers to the vendor’s service by default, which is identifying project data under the telemetry review rules. The behavior is disclosed and can be disabled, so this warrants a warning rather than a malicious verdict.
Evidence
app.plugin.jsplugin/telemetry.jsReactNativeAlpr.podspecandroid/build.gradleSDK-LICENSE.md
Network endpoints1
alpr.parkr.app/t/build
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Expo prebuild sends the app’s bundle or package identifier, build type, platform, license state, and version details to the telemetry function.
- Build telemetry posts to https://alpr.parkr.app/t/build by default unless an opt-out environment variable is set.
- The CocoaPods podspec collects Xcode application bundle identifiers and sends them to the same endpoint during pod installation.
Evidence against
- The package documents build-time telemetry and provides DO_NOT_TRACK=1 or ALPR_TELEMETRY=0 opt-outs.
- The SDK license says runtime reports exclude device and user identifiers, images, and plate data; runtime telemetry can be disabled.
- The package describes on-device plate recognition, and the inspected JavaScript entry point delegates recognition to the native module.
Behavioral surface
CryptoEnvironmentVarsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedios/AlprKit.xcframework/ios-arm64_x86_64-simulator/AlprKit.framework/AlprKitView file
•path = ios/AlprKit.xcframework/ios-arm64_x86_64-simulator/AlprKit.framework/AlprKit
kind = native_binary
sizeBytes = 612264
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
ios/AlprKit.xcframework/ios-arm64_x86_64-simulator/AlprKit.framework/AlprKitView on unpkgios/AlprKit.xcframework/_CodeSignature/CodeSignatureView file
•path = ios/AlprKit.xcframework/_CodeSignature/CodeSignature
kind = high_entropy_blob
sizeBytes = 9087
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
ios/AlprKit.xcframework/_CodeSignature/CodeSignatureView on unpkgFindings
1 High7 Medium4 Low
HighShips High Entropy Blobios/AlprKit.xcframework/_CodeSignature/CodeSignature
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryios/AlprKit.xcframework/ios-arm64_x86_64-simulator/AlprKit.framework/AlprKit
MediumStructural Risk Force Deep Review
MediumAi Review Evidenceapp.plugin.js
MediumAi Review Evidenceplugin/telemetry.js
MediumAi Review EvidenceReactNativeAlpr.podspec
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to react-native-alpr@0.4.2.
See all versions of react-native-alpr for other recorded verdicts.
- Review the evidence and your use of react-native-alpr@0.4.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.