registry / react-native-image-stitcher / 0.21.0

react-native-image-stitcher@0.21.0

Pose-aware panorama capture + stitching for React Native. One <Camera> component, both tap-to-photo and hold-to-pan modes, both AR-backed and IMU-fallback capture paths.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 148 file(s), 1.38 MB of source, external domains: github.com

Source & flagged code

5 flagged

package.jsonView file

Lines 17-57json

17 "android/src/main/cpp",

18 "android/src/main/AndroidManifest.xml",

19 "cpp",

20 "!cpp/tests",

21 "!cpp/tests/**",

22 "scripts/postinstall-fetch-binaries.js",

23 "scripts/opencv-version.txt",

24 "RNImageStitcher.podspec",

25 "react-native.config.js",

26 "LICENSE",

27 "NOTICE",

28 "README.md",

29 "CHANGELOG.md"

30 ],

31 "scripts": {

32 "build": "npm run clean && tsc -p tsconfig.build.json",

33 "typecheck": "tsc --noEmit",

34 "test": "jest",

35 "clean": "rm -rf dist",

36 "prepublishOnly": "npm run build && npm run typecheck && npm test",

37 "postinstall": "node scripts/postinstall-fetch-binaries.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

38 },

39 "keywords": [

40 "react-native",

41 "panorama",

42 "stitching",

43 "image-stitcher",

44 "camera",

45 "opencv",

46 "arkit",

47 "arcore",

48 "vision-camera",

49 "shelf-scan"

50 ],

51 "license": "Apache-2.0",

52 "repository": {

53 "type": "git",

54 "url": "https://github.com/bhargavkanda/react-native-image-stitcher.git"

55 },

56 "bugs": {

57 "url": "https://github.com/bhargavkanda/react-native-image-stitcher/issues"

scripts/postinstall-fetch-binaries.jsView file

Lines 1-53javascript

1#!/usr/bin/env node

2/* eslint-disable no-console */

3/**

4 * postinstall-fetch-binaries.js — fetch OpenCV binaries matching this

5 * package's version from GitHub Releases.

6 *

7 * Runs after `npm install` / `yarn install` in the consumer app.

8 * Reads `package.json#version`, fetches the matching iOS xcframework

9 * + Android per-ABI archives, extracts them into the expected

10 * locations so `pod install` and `./gradlew` find them on the next

11 * native build.

react-native.config.jsView file

Lines 1-32javascript

1/**

2 * react-native.config.js — describe this SDK's native surface to RN

3 * autolinking. Without this file autolinking would look for a

4 * podspec named `CaptureSdk.podspec` (the slug of the package name

5 * `react-native-image-stitcher`) and miss our actual file

6 * `RNImageStitcher.podspec` at the package root.

7 *

8 * Declaring the explicit paths here also lets autolinking find the

9 * Android source directory once Phase 3 lands (currently absent —

10 * the `android` block is included now so the iOS-Android shape is

11 * symmetric and operators don't have to re-edit this file mid-work).

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-fetch-binaries.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/postinstall-fetch-binaries.jsView file

33const https = require('https'); L34: const { execSync } = require('child_process'); L35: const zlib = require('zlib');

High

Child Process

Package source references child process execution.

scripts/postinstall-fetch-binaries.jsView on unpkg · L33

7Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network L7: * Runs after `npm install` / `yarn install` in the consumer app. L8: * Reads `package.json#version`, fetches the matching iOS xcframework L9: * + Android per-ABI archives, extracts them into the expected ... L32: const path = require('path'); L33: const https = require('https'); L34: const { execSync } = require('child_process'); L35: const zlib = require('zlib'); L36: L37: const PKG = require(path.join(__dirname, '..', 'package.json')); L38: const VERSION = PKG.version; ... L45: 'https://github.com/bhargavkanda/react-native-image-stitcher/releases/download'; L46: const BASE_URL = process.env.OPENCV_BINARY_BASE_URL || DEFAULT_BASE_URL;

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/postinstall-fetch-binaries.jsView on unpkg · L7

32const path = require('path'); L33: const https = require('https'); L34: const { execSync } = require('child_process'); L35: const zlib = require('zlib'); ... L45: 'https://github.com/bhargavkanda/react-native-image-stitcher/releases/download'; L46: const BASE_URL = process.env.OPENCV_BINARY_BASE_URL || DEFAULT_BASE_URL; L47:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/postinstall-fetch-binaries.jsView on unpkg · L32

react-native.config.jsView file

12*/ L13: const path = require('path'); L14:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

react-native.config.jsView on unpkg · L12

Findings

4 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/postinstall-fetch-binaries.js

HighEntrypoint Build Divergencescripts/postinstall-fetch-binaries.js

HighSame File Env Network Executionscripts/postinstall-fetch-binaries.js

MediumDynamic Requirereact-native.config.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

package.jsonView file

Lines 17-57json

17 "android/src/main/cpp",

18 "android/src/main/AndroidManifest.xml",

19 "cpp",

20 "!cpp/tests",

21 "!cpp/tests/**",

22 "scripts/postinstall-fetch-binaries.js",

23 "scripts/opencv-version.txt",

24 "RNImageStitcher.podspec",

25 "react-native.config.js",

26 "LICENSE",

27 "NOTICE",

28 "README.md",

29 "CHANGELOG.md"

30 ],

31 "scripts": {

32 "build": "npm run clean && tsc -p tsconfig.build.json",

33 "typecheck": "tsc --noEmit",

34 "test": "jest",

35 "clean": "rm -rf dist",

36 "prepublishOnly": "npm run build && npm run typecheck && npm test",

37 "postinstall": "node scripts/postinstall-fetch-binaries.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

38 },

39 "keywords": [

40 "react-native",

41 "panorama",

42 "stitching",

43 "image-stitcher",

44 "camera",

45 "opencv",

46 "arkit",

47 "arcore",

48 "vision-camera",

49 "shelf-scan"

50 ],

51 "license": "Apache-2.0",

52 "repository": {

53 "type": "git",

54 "url": "https://github.com/bhargavkanda/react-native-image-stitcher.git"

55 },

56 "bugs": {

57 "url": "https://github.com/bhargavkanda/react-native-image-stitcher/issues"

scripts/postinstall-fetch-binaries.jsView file

Lines 1-53javascript

1#!/usr/bin/env node

2/* eslint-disable no-console */

3/**

4 * postinstall-fetch-binaries.js — fetch OpenCV binaries matching this

5 * package's version from GitHub Releases.

6 *

7 * Runs after `npm install` / `yarn install` in the consumer app.

8 * Reads `package.json#version`, fetches the matching iOS xcframework

9 * + Android per-ABI archives, extracts them into the expected

10 * locations so `pod install` and `./gradlew` find them on the next

11 * native build.

react-native.config.jsView file

Lines 1-32javascript

1/**

2 * react-native.config.js — describe this SDK's native surface to RN

3 * autolinking. Without this file autolinking would look for a

4 * podspec named `CaptureSdk.podspec` (the slug of the package name

5 * `react-native-image-stitcher`) and miss our actual file

6 * `RNImageStitcher.podspec` at the package root.

7 *

8 * Declaring the explicit paths here also lets autolinking find the

9 * Android source directory once Phase 3 lands (currently absent —

10 * the `android` block is included now so the iOS-Android shape is

11 * symmetric and operators don't have to re-edit this file mid-work).