YARA matches indicate process command line access and JavaScript evaluation, but these are likely legitimate uses for debugging and testing.
No verification record available.
The YARA rules proc_d_cmdline and proc_cmdline_near match the file FuseboxPerfettoDataSource.cpp because it accesses the command line of other processes through /proc/%d/cmdline. This is a common practice for debugging and profiling tools, and react-native might use it for performance monitoring, which is related to the reactperflogger directory. The YARA rule js_eval_fx_str matches the file BridgingTest.h because it uses eval() to evaluate a JavaScript string. This is part of a testing framework, which is a legitimate use case. Given the low confidence of the matches and the legitimate use cases, the package is not classified as malware.
