Multiple embedded executables and YARA matches, but no conclusive evidence of malicious intent. Likely related to hermesc and dependencies.
No verification record available.
The package contains multiple embedded executables, which raises security concerns. However, these executables appear to be related to hermesc, a JavaScript engine, and its dependencies (ICU, MSVCP, VCRUNTIME). These dependencies are commonly packaged with software that relies on them. The YARA rule matches 'proc_d_cmdline' and 'proc_cmdline_near' in FuseboxPerfettoDataSource.cpp indicate access to command-line arguments of other processes, which could be legitimate for performance logging. The YARA rule 'high_entropy_trailer' matched in hermesc could indicate viral infection, but the confidence is low. The YARA rule 'js_eval_fx_str' matched in BridgingTest.h indicates the usage of eval function, which is not necessarily malicious. Overall, while there are suspicious findings, they do not provide conclusive evidence of malicious intent, especially considering the context of the package being react-native.
