This is a duplicate of #2544, which has more detail on the same ask (Hermes bytecode decompilation + React Native-specific checks).

For context on scope: I checked the codebase and there's currently no React Native/Hermes support at all - the only RN-related reference anywhere is a Frida script for bypassing emulator detection during dynamic analysis, unrelated to static analysis. Adding real support here would mean:

Detecting a React Native app in the first place (e.g. presence of index.android.bundle / libhermes.so).
Decompiling Hermes bytecode back into readable JS - Hermes bytecode is a custom binary format, so this needs an external decompiler (e.g. hermes-dec/hbctool), which is a new dependency with its own maintenance/licensing considerations.
New JS-level static analysis rules (secrets, insecure API usage, etc.) applied to the decompiled output.

That's a meaningfully large, new analysis pipeline rather than a scoped fix, and probably worth a design discussion (which decompiler to depend on, how it fits into the existing static analyzer architecture) before someone commits to a PR for it, since it seems like the kind of feature that could easily go on unnoticed once written if it doesn't match the direction MobSF is taking.

[FEATURE] - React Native Security Analysis Support #2635

Description

Activity

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions