react-native-shbib-tools@2.0.73

Analysis

react-native-shbib-tools@2.0.73 ships five JavaScript files that are output of the javascript-obfuscator tool — navigations/helpers/index.js (162 KB, ~4,300 _0x identifiers), form/builder/index.js, form/builder/dependency.js, navigations/builder/index.js and navigations/navigators/index.js — with control-flow flattening, a rotated string array, and identifiers and string-array entries written as \x hex escapes to defeat literal-string matching. The package manifest is stripped to name, version, main and license: no repository, no dependencies, no build configuration that would explain obfuscating a React Native UI/form/navigation library, and no lifecycle hooks. index.js re-exports a `services` symbol that is never imported, so the entry module is broken. Static inspection of this version found no network, process-execution, filesystem or environment-variable access and no hardcoded URL, host or IP: the obfuscated string arrays contain only property names, module specifiers and obfuscator filler. No network IOC is present in this version; the concern is the unexplained obfuscation of otherwise plain library code under a package name that has previously carried malicious content.