registry / react-native-image-stitcher / 0.22.0

react-native-image-stitcher@0.22.0

Pose-aware panorama capture + stitching for React Native. One <Camera> component, both tap-to-photo and hold-to-pan modes, both AR-backed and IMU-fallback capture paths.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 150 file(s), 1.42 MB of source, external domains: github.com

Source & flagged code

5 flagged

package.jsonView file

Lines 17-57json

17 "android/src/main/cpp",

18 "android/src/main/AndroidManifest.xml",

19 "cpp",

20 "!cpp/tests",

21 "!cpp/tests/**",

22 "scripts/postinstall-fetch-binaries.js",

23 "scripts/opencv-version.txt",

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-fetch-binaries.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/postinstall-fetch-binaries.jsView file

33const https = require('https'); L34: const { execSync } = require('child_process'); L35: const zlib = require('zlib');

High

Child Process

Package source references child process execution.

scripts/postinstall-fetch-binaries.jsView on unpkg · L33

7Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network L7: * Runs after `npm install` / `yarn install` in the consumer app. L8: * Reads `package.json#version`, fetches the matching iOS xcframework L9: * + Android per-ABI archives, extracts them into the expected ... L32: const path = require('path'); L33: const https = require('https'); L34: const { execSync } = require('child_process'); L35: const zlib = require('zlib'); L36: L37: const PKG = require(path.join(__dirname, '..', 'package.json')); L38: const VERSION = PKG.version; ... L45: 'https://github.com/bhargavkanda/react-native-image-stitcher/releases/download'; L46: const BASE_URL = process.env.OPENCV_BINARY_BASE_URL || DEFAULT_BASE_URL;

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/postinstall-fetch-binaries.jsView on unpkg · L7

32const path = require('path'); L33: const https = require('https'); L34: const { execSync } = require('child_process'); L35: const zlib = require('zlib'); ... L45: 'https://github.com/bhargavkanda/react-native-image-stitcher/releases/download'; L46: const BASE_URL = process.env.OPENCV_BINARY_BASE_URL || DEFAULT_BASE_URL; L47:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/postinstall-fetch-binaries.jsView on unpkg · L32

react-native.config.jsView file

12*/ L13: const path = require('path'); L14:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

react-native.config.jsView on unpkg · L12

Findings

4 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/postinstall-fetch-binaries.js

HighEntrypoint Build Divergencescripts/postinstall-fetch-binaries.js

HighSame File Env Network Executionscripts/postinstall-fetch-binaries.js

MediumDynamic Requirereact-native.config.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

scripts/postinstall-fetch-binaries.jsView file

Lines 1-53javascript

1#!/usr/bin/env node

2/* eslint-disable no-console */

3/**

4 * postinstall-fetch-binaries.js — fetch OpenCV binaries matching this

5 * package's version from GitHub Releases.

6 *

7 * Runs after `npm install` / `yarn install` in the consumer app.

8 * Reads `package.json#version`, fetches the matching iOS xcframework

9 * + Android per-ABI archives, extracts them into the expected

10 * locations so `pod install` and `./gradlew` find them on the next

11 * native build.

12 *

13 * The mechanism is fault-tolerant:

14 * - Already-on-disk binaries → skip fetch (matched by .opencv-fetched

15 * marker file recording the version).

16 * - Transient network failures → retry up to 3× with exponential

17 * backoff.

18 * - Unreachable GH Releases (e.g., offline install of a fresh

19 * package version) → exit cleanly with a warning + instructions

20 * to re-run `npm install` later. This lets `npm install` itself

21 * succeed (the native build will fail later with a clear error,

22 * vs blocking the JS-only `npm install` step here).

23 *

24 * Env overrides:

25 * OPENCV_BINARY_BASE_URL — override the default GH Releases URL

26 * (useful for internal mirrors).

27 * SKIP_OPENCV_FETCH=1 — bail out (used by CI builds where the

28 * binaries are pre-staged manually).

29 */

31const fs = require('fs');

32const path = require('path');

33const https = require('https');

34const { execSync } = require('child_process');

35const zlib = require('zlib');

High

Child Process

Package source references child process execution.

scripts/postinstall-fetch-binaries.jsView on unpkg · L33

37const PKG = require(path.join(__dirname, '..', 'package.json'));

38const VERSION = PKG.version;

39const TAG = `v${VERSION}`;

41// When this script is moved to the public lib repo, BASE_URL becomes

42// `https://github.com/bhargavkanda/react-native-image-stitcher/releases/download`.

43// Until then (development in the monorepo), allow override via env.

44const DEFAULT_BASE_URL =

45 'https://github.com/bhargavkanda/react-native-image-stitcher/releases/download';

46const BASE_URL = process.env.OPENCV_BINARY_BASE_URL || DEFAULT_BASE_URL;

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/postinstall-fetch-binaries.jsView on unpkg · L7

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/postinstall-fetch-binaries.jsView on unpkg · L32

48const PKG_ROOT = path.join(__dirname, '..');

49const IOS_DEST = path.join(PKG_ROOT, 'ios', 'Frameworks');

50const ANDROID_DEST = path.join(PKG_ROOT, 'android', 'vendor');

51const MARKER = path.join(PKG_ROOT, '.opencv-fetched');

53const IOS_ASSET = `RNImageStitcher-${TAG}-ios.zip`;

react-native.config.jsView file

Lines 1-32javascript

1/**

2 * react-native.config.js — describe this SDK's native surface to RN

3 * autolinking. Without this file autolinking would look for a

4 * podspec named `CaptureSdk.podspec` (the slug of the package name

5 * `react-native-image-stitcher`) and miss our actual file

6 * `RNImageStitcher.podspec` at the package root.

7 *

8 * Declaring the explicit paths here also lets autolinking find the

9 * Android source directory once Phase 3 lands (currently absent —

10 * the `android` block is included now so the iOS-Android shape is

11 * symmetric and operators don't have to re-edit this file mid-work).

12 */

13const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

react-native.config.jsView on unpkg · L12

15module.exports = {

16 dependency: {

17 platforms: {

18 ios: {

19 podspecPath: path.join(__dirname, 'RNImageStitcher.podspec'),

20 },

21 android: {

22 // RELATIVE path on purpose. RN's autolinking computes

23 // `path.join(root, sourceDir)` where `root` is the package

24 // root in node_modules (a symlink in our case). An ABSOLUTE

25 // sourceDir gets concatenated by path.join rather than

26 // treated as already-resolved, producing a broken double

27 // path and silently failing detection. Relative `'android'`

28 // joins cleanly and resolves through the symlink to the

29 // real Android module folder.

30 sourceDir: 'android',

31 },

32 },