Supply-chain attacks move fast. We stay ahead.

Free campaign tracking

Spectra Assure

Community

Toolbox

Explore

Learn

ReversingLabs

Spectra Assure

Community

Maven

Search by package name, PURL or hash

warningRisk: Hardening

Scanned:

com.facebook.react:react-android

Artifact:

latest

Top 10k

A framework for building native apps with React

License: Permissive (MIT)

Published:

See on Maven

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

24 debugging symbols found

Security

Vulnerabilities

No known vulnerabilities detected

Hardening

7 reduced effectiveness mitigations

Threats

Tampering

No evidence of software tampering

Malware

No evidence of malware inclusion

Overview issues9 vulnerabilities0 malware0 behaviors90 dependencies21 contributors1 versions251

Popularity

N/A

Total Downloads

Contributor

Declared Dependencies

Dependents

Top issues

See all issues

Problem

Buffer overrun protection on Linux is achieved in two ways. The most common solution is to use the stack canary (also called cookie). The stack canary is a special value written onto the stack that allows the operating system to detect and terminate the program if a stack overrun occurs. In most cases, compilers will apply the stack canary conservatively in order to avoid a negative performance impact. Therefore, stack canaries are often used together with another stack overrun mitigation - fortified functions. Fortified functions are usually wrappers around standard glibc functions (such as memcpy) which perform boundary checks either at compile time or run time to determine if a memory violation has occurred. The compiler needs additional context to generate such calls (for example, array size that needs to be known at compile time). Because of this, the compiler will virtually never substitute all viable functions with their fortified counterparts in complex programs. However, when combined with the stack canary, fortified functions provide a good measure of buffer overrun protection.

Prevalence in Maven community

No prevalence information at this time

Next steps

Presence of unfortified string functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Prevalence in Maven community

No prevalence information at this time

Next steps

Presence of unfortified memory functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Prevalence in Maven community

No prevalence information at this time

Next steps

Presence of some input functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Stack canary is a special value written onto the stack that allows the operating system to detect and terminate the program if a stack overrun occurs. Older compilers might generate stack cookies in a way that makes it possible to determine their value, allowing the attacker to render the mitigation ineffective.

Prevalence in Maven community

No prevalence information at this time

Next steps

In GCC, you can enable the stack canary with -fstack-protector-strong or -fstack-protector-all flag, but it may also be enabled by default in more recent versions of the compiler.

Consider upgrading your compiler.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. Top-level domains (TLD) are a part of the Domain Name System (DNS), and are used to lookup an Internet Protocol (IP) address of a requested website. There are a few different types of top-level domains. Generic, sponsored and country-code TLDs are generally accessible to the public. Registrars that govern the assignment of domain names within the TLD may choose to sell specific domain names to an interested party. However, some registrars are known to have less strict rules for assigning domain names. Attackers often abuse gaps in governance and actively seek to register their malicious domains in such TLDs. This issue is raised for all domains registered within TLDs that harbor an excessive number of malicious sites. While the presence of suspicious TLDs does not imply malicious intent, all of its uses in a software package should be documented and approved.

Prevalence in Maven community

No prevalence information at this time

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider changing the top-level domain to avoid being flagged by security solutions.

Top behaviors

See all behaviors

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Top vulnerabilities

No vulnerabilities found.

FAQ for com.facebook.react:react-android

What is com.facebook.react:react-android?

A framework for building native apps with React. For more information about this package, visit its homepage.

Is com.facebook.react:react-android malicious or is it safe to use?

The Java package com.facebook.react:react-android was scanned for malware, software tampering, risky behaviors, exposed secrets and known vulnerabilities. The package contains risks, and the analysis results should be reviewed before it is downloaded and used. Visit the Issues and Behaviors sections of the analysis for more details.

Does com.facebook.react:react-android have known vulnerabilities?

No vulnerabilities have been detected for this version of com.facebook.react:react-android.

Is com.facebook.react:react-android popular?

The Java package com.facebook.react:react-android ranks among the top 10000 projects in this community. A package's popularity is not a good indicator of its safety, visit the SAFE Assessment section to see the full analysis of package deployment risk categories.

Read our best practices for protecting your software supply chain guide.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

Popularity

N/A

Total Downloads

Contributor

Declared Dependencies

Dependents

Top issues

See all issues

Problem

Prevalence in Maven community

No prevalence information at this time

Next steps

Presence of unfortified string functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Prevalence in Maven community

No prevalence information at this time

Next steps

Presence of unfortified memory functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Prevalence in Maven community

No prevalence information at this time

Next steps

Presence of some input functions may indicate use of unsafe programming practices, and you should avoid it if possible.

In GCC, enable fortified functions with -fstack-protector and -D_FORTIFY_SOURCE=2 flag, while using at least -O1 optimization level.

Problem

Prevalence in Maven community

No prevalence information at this time

Next steps

In GCC, you can enable the stack canary with -fstack-protector-strong or -fstack-protector-all flag, but it may also be enabled by default in more recent versions of the compiler.

Consider upgrading your compiler.

Problem

Prevalence in Maven community

No prevalence information at this time

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider changing the top-level domain to avoid being flagged by security solutions.

Top behaviors

See all behaviors

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Prevalence in Maven community

No behavior prevalence information at this time

Top vulnerabilities

No vulnerabilities found.

com.facebook.react:react-android

SAFE Assessment

Compliance

Security

Threats

Popularity

Top issues

SQ18105Detected Linux executable files compiled without any kind of buffer overrun protection while using banned string functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in Maven community

Next steps

SQ18106Detected Linux executable files compiled without any kind of buffer overrun protection while using banned memory functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in Maven community

Next steps

SQ18107Detected Linux executable files compiled without any kind of buffer overrun protection while using banned input functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in Maven community

Next steps

SQ18109Detected Linux executable files that use a deprecated method to store the security cookie, making the buffer overrun vulnerability mitigation protection less effective.Causes risk: reduced effectiveness mitigationshardening

Problem

Prevalence in Maven community

Next steps

TH17118Detected presence of files containing URLs that use suspicious top-level domains.hunting

Problem

Prevalence in Maven community

Next steps

Top behaviors

Contains URLs that link to interesting file formats.network

Prevalence in Maven community

Executes a file.execution

Prevalence in Maven community

Creates a process.execution

Prevalence in Maven community

Contains Visa credit card numbers.steal

Prevalence in Maven community

Contains Maestro credit card numbers.steal

Prevalence in Maven community

Top vulnerabilities

FAQ for com.facebook.react:react-android

What is com.facebook.react:react-android?

Is com.facebook.react:react-android malicious or is it safe to use?

Does com.facebook.react:react-android have known vulnerabilities?

Is com.facebook.react:react-android popular?

Did you know...

Popularity

Top issues

SQ18105Detected Linux executable files compiled without any kind of buffer overrun protection while using banned string functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in Maven community

Next steps

SQ18106Detected Linux executable files compiled without any kind of buffer overrun protection while using banned memory functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in Maven community

Next steps

SQ18107Detected Linux executable files compiled without any kind of buffer overrun protection while using banned input functions.Causes risk: misconfigured toolchains detectedhardening

Problem

Prevalence in Maven community

Next steps

SQ18109Detected Linux executable files that use a deprecated method to store the security cookie, making the buffer overrun vulnerability mitigation protection less effective.Causes risk: reduced effectiveness mitigationshardening

Problem

Prevalence in Maven community

Next steps

TH17118Detected presence of files containing URLs that use suspicious top-level domains.hunting

Problem

Prevalence in Maven community

Next steps

Top behaviors

Contains URLs that link to interesting file formats.network

Prevalence in Maven community

Executes a file.execution

Prevalence in Maven community

Creates a process.execution

Prevalence in Maven community

Contains Visa credit card numbers.steal

Prevalence in Maven community

Contains Maestro credit card numbers.steal

Prevalence in Maven community

Top vulnerabilities