capacitor-freerasp 2.5.0 → 3.0.0

package/CHANGELOG.md

@@ -5,6 +5,67 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.0.0] - 2026-05-15
+
+- Android SDK version: 18.3.0
+- iOS SDK version: 6.14.4
+
+### Breaking
+
+- `SuspiciousAppInfo.reason` (String) renamed to `reasons` (string[])
+- Value `"blacklist"` in `reasons` renamed to `"blocklist"`
+- Removed `TalsecMalwareConfig` and `TalsecAndroidConfig.malwareConfig`
+- `SuspiciousAppDetectionConfig.malwareScanScope` and `reasonMode` are now required
+
+### Capacitor
+
+#### Added
+
+- `SuspiciousAppDetectionConfig` for malware detection configuration
+
+#### Removed
+
+- `TalsecMalwareConfig` type and `TalsecAndroidConfig.malwareConfig` field
+
+### Android
+
+#### Added
+
+- New API class `SuspiciousAppDetectionConfig` that can be used to configure malware detection
+- New API for malware detection configuration in `TalsecConfig`, see `TalsecConfig.Builder#suspiciousAppDetection`
+
+#### Fixed
+
+- Fixed `VerifyError` caused by JaCoCo bytecode instrumentation
+- Fixed a potential cause of crash in the multi-instance detector
+- Fixed Java interoperability of `ScreenProtector` methods
+- Fixed Kotlin classpath conflicts in SDK dependency resolution (Kotlin 2.0.0)
+
+#### Changed
+
+- Fine-tuned location spoofing detection
+- Modified malware incident log structure for better aggregation
+
+## [2.5.1] - 2026-03-24
+
+- Android SDK version: 18.0.4
+- iOS SDK version: 6.14.4
+
+### Capacitor
+
+#### Fixed
+
+- Fixed case where event dispatchers on Android were not initialized before calling onResume at the app launch
+
+### iOS
+
+#### Fixed
+
+- Fixed new jailbreak checks false positives on iOS 14 and 13.
+- Fixed false positives with jailbreak on iOS 15 and 16.
+- Fixed issue with app crashing on screenshot/screen recording.
+- Fixed retrigger jailbreak issue on iOS 15 and 16.
+
 ## [2.5.0] - 2026-03-03
 
 - Android SDK version: 18.0.4

package/android/build.gradle

@@ -76,5 +76,5 @@ dependencies {
     androidTestImplementation "androidx.test.ext:junit:$androidxJunitVersion"
     androidTestImplementation "androidx.test.espresso:espresso-core:$androidxEspressoCoreVersion"
     
-    implementation 'com.aheaditec.talsec.security:TalsecSecurity-Community-Capacitor:18.0.4'
+    implementation 'com.aheaditec.talsec.security:TalsecSecurity-Community-Capacitor:18.3.0'
 }

package/android/src/main/java/com/aheaditec/freerasp/FreeraspPlugin.kt

@@ -5,10 +5,12 @@ import android.os.Build
 import android.os.Handler
 import android.os.HandlerThread
 import android.os.Looper
+import com.aheaditec.freerasp.dispatchers.ExecutionStateDispatcher
+import com.aheaditec.freerasp.dispatchers.ThreatDispatcher
 import com.aheaditec.freerasp.utils.Utils
 import com.aheaditec.freerasp.utils.getArraySafe
-import com.aheaditec.freerasp.utils.getNestedArraySafe
 import com.aheaditec.freerasp.utils.toEncodedJSArray
+import com.aheaditec.freerasp.utils.toSuspiciousAppDetectionConfig
 import com.aheaditec.talsec_security.security.api.SuspiciousAppInfo
 import com.aheaditec.talsec_security.security.api.Talsec
 import com.aheaditec.talsec_security.security.api.TalsecConfig
@@ -31,10 +33,6 @@ class FreeraspPlugin : Plugin() {
 
     override fun load() {
         initializeEventKeys()
-        val pluginCallback: CapacitorCallback = { eventName, data ->
-            notifyListeners(eventName, data, true)
-        }
-        PluginThreatHandler.initializeDispatchers(PluginListener(context, pluginCallback))
         super.load()
     }
 
@@ -78,11 +76,14 @@ class FreeraspPlugin : Plugin() {
     @PluginMethod(returnType = PluginMethod.RETURN_NONE)
     override fun addListener(call: PluginCall) {
         val eventName = call.getString("eventName")
+        val pluginCallback: CapacitorCallback = { eventName, data ->
+            notifyListeners(eventName, data, true)
+        }
         if (eventName == ThreatEvent.CHANNEL_NAME) {
-            PluginThreatHandler.threatDispatcher.registerListener()
+            ThreatDispatcher.registerListener(PluginListener(context, pluginCallback))
         }
         if (eventName == RaspExecutionStateEvent.CHANNEL_NAME) {
-            PluginThreatHandler.executionStateDispatcher.registerListener()
+            ExecutionStateDispatcher.registerListener(PluginListener(context, pluginCallback))
         }
         super.addListener(call)
     }
@@ -91,31 +92,31 @@ class FreeraspPlugin : Plugin() {
     fun removeListenerForEvent(call: PluginCall) {
         val eventName = call.getString("eventName")
         if (eventName == ThreatEvent.CHANNEL_NAME) {
-            PluginThreatHandler.threatDispatcher.unregisterListener()
+            ThreatDispatcher.unregisterListener()
         }
         if (eventName == RaspExecutionStateEvent.CHANNEL_NAME) {
-            PluginThreatHandler.executionStateDispatcher.unregisterListener()
+            ExecutionStateDispatcher.unregisterListener()
         }
     }
 
     override fun handleOnPause() {
         super.handleOnPause()
-        PluginThreatHandler.threatDispatcher.onPause()
-        PluginThreatHandler.executionStateDispatcher.onPause()
+        ThreatDispatcher.onPause()
+        ExecutionStateDispatcher.onPause()
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
             ScreenProtector.unregister(activity)
         }
         if (activity.isFinishing) {
-            PluginThreatHandler.threatDispatcher.unregisterListener()
-            PluginThreatHandler.executionStateDispatcher.unregisterListener()
+            ThreatDispatcher.unregisterListener()
+            ExecutionStateDispatcher.unregisterListener()
             PluginThreatHandler.unregisterSDKListener(context)
         }
     }
 
     override fun handleOnResume() {
         super.handleOnResume()
-        PluginThreatHandler.threatDispatcher.onResume()
-        PluginThreatHandler.executionStateDispatcher.onResume()
+        ThreatDispatcher.onResume()
+        ExecutionStateDispatcher.onResume()
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
             ScreenProtector.register(activity)
         }
@@ -314,13 +315,12 @@ class FreeraspPlugin : Plugin() {
             .prod(configJson.getBool("isProd") ?: true)
             .killOnBypass(configJson.getBool("killOnBypass") ?: false)
 
-        if (androidConfig.has("malwareConfig")) {
-            val malwareConfig = androidConfig.getJSONObject("malwareConfig")
-            talsecBuilder.whitelistedInstallationSources(malwareConfig.getArraySafe("whitelistedInstallationSources"))
-            talsecBuilder.blacklistedHashes(malwareConfig.getArraySafe("blacklistedHashes"))
-            talsecBuilder.blacklistedPackageNames(malwareConfig.getArraySafe("blacklistedPackageNames"))
-            talsecBuilder.suspiciousPermissions(malwareConfig.getNestedArraySafe("suspiciousPermissions"))
+        if (androidConfig.has("suspiciousAppDetectionConfig")) {
+            talsecBuilder.suspiciousAppDetection(
+                androidConfig.getJSONObject("suspiciousAppDetectionConfig").toSuspiciousAppDetectionConfig()
+            )
         }
+
         return talsecBuilder.build()
     }
 

package/android/src/main/java/com/aheaditec/freerasp/PluginThreatHandler.kt

@@ -10,107 +10,100 @@ import com.aheaditec.freerasp.events.ThreatEvent
 
 internal object PluginThreatHandler {
 
-  internal lateinit var threatDispatcher: ThreatDispatcher
-  internal lateinit var executionStateDispatcher: ExecutionStateDispatcher
-
-    fun initializeDispatchers(listener: FreeraspPlugin.PluginListener) {
-        threatDispatcher = ThreatDispatcher(listener)
-        executionStateDispatcher = ExecutionStateDispatcher(listener)
-    }
 
     private val threatDetected = object : ThreatListener.ThreatDetected() {
 
         override fun onRootDetected() {
-            threatDispatcher.dispatchThreat(ThreatEvent.PrivilegedAccess)
+            ThreatDispatcher.dispatchThreat(ThreatEvent.PrivilegedAccess)
         }
 
         override fun onDebuggerDetected() {
-            threatDispatcher.dispatchThreat(ThreatEvent.Debug)
+            ThreatDispatcher.dispatchThreat(ThreatEvent.Debug)
         }
 
         override fun onEmulatorDetected() {
-            threatDispatcher.dispatchThreat(ThreatEvent.Simulator)
+            ThreatDispatcher.dispatchThreat(ThreatEvent.Simulator)
         }
 
         override fun onTamperDetected() {
-            threatDispatcher.dispatchThreat(ThreatEvent.AppIntegrity)
+            ThreatDispatcher.dispatchThreat(ThreatEvent.AppIntegrity)
         }
 
         override fun onUntrustedInstallationSourceDetected() {
-            threatDispatcher.dispatchThreat(ThreatEvent.UnofficialStore)
+            ThreatDispatcher.dispatchThreat(ThreatEvent.UnofficialStore)
         }
 
         override fun onHookDetected() {
-            threatDispatcher.dispatchThreat(ThreatEvent.Hooks)
+            ThreatDispatcher.dispatchThreat(ThreatEvent.Hooks)
         }
 
         override fun onDeviceBindingDetected() {
-            threatDispatcher.dispatchThreat(ThreatEvent.DeviceBinding)
+            ThreatDispatcher.dispatchThreat(ThreatEvent.DeviceBinding)
         }
 
         override fun onObfuscationIssuesDetected() {
-            threatDispatcher.dispatchThreat(ThreatEvent.ObfuscationIssues)
+            ThreatDispatcher.dispatchThreat(ThreatEvent.ObfuscationIssues)
         }
 
         override fun onMalwareDetected(suspiciousAppInfos: MutableList<SuspiciousAppInfo>) {
-            threatDispatcher.dispatchMalware(suspiciousAppInfos ?: mutableListOf())
+            ThreatDispatcher.dispatchMalware(suspiciousAppInfos ?: mutableListOf())
         }
 
         override fun onScreenshotDetected() {
-            threatDispatcher.dispatchThreat(ThreatEvent.Screenshot)
+            ThreatDispatcher.dispatchThreat(ThreatEvent.Screenshot)
         }
 
         override fun onScreenRecordingDetected() {
-            threatDispatcher.dispatchThreat(ThreatEvent.ScreenRecording)
+            ThreatDispatcher.dispatchThreat(ThreatEvent.ScreenRecording)
         }
 
         override fun onMultiInstanceDetected() {
-            threatDispatcher.dispatchThreat(ThreatEvent.MultiInstance)
+            ThreatDispatcher.dispatchThreat(ThreatEvent.MultiInstance)
         }
 
         override fun onUnsecureWifiDetected() {
-            threatDispatcher.dispatchThreat(ThreatEvent.UnsecureWifi)
+            ThreatDispatcher.dispatchThreat(ThreatEvent.UnsecureWifi)
         }
 
         override fun onTimeSpoofingDetected() {
-            threatDispatcher.dispatchThreat(ThreatEvent.TimeSpoofing)
+            ThreatDispatcher.dispatchThreat(ThreatEvent.TimeSpoofing)
         }
 
         override fun onLocationSpoofingDetected() {
-            threatDispatcher.dispatchThreat(ThreatEvent.LocationSpoofing)
+            ThreatDispatcher.dispatchThreat(ThreatEvent.LocationSpoofing)
         }
 
         override fun onAutomationDetected() {
-            threatDispatcher.dispatchThreat(ThreatEvent.Automation)
+            ThreatDispatcher.dispatchThreat(ThreatEvent.Automation)
         }
     }
 
     private val deviceState = object : ThreatListener.DeviceState() {
 
         override fun onUnlockedDeviceDetected() {
-            threatDispatcher.dispatchThreat(ThreatEvent.Passcode)
+            ThreatDispatcher.dispatchThreat(ThreatEvent.Passcode)
         }
 
         override fun onHardwareBackedKeystoreNotAvailableDetected() {
-            threatDispatcher.dispatchThreat(ThreatEvent.SecureHardwareNotAvailable)
+            ThreatDispatcher.dispatchThreat(ThreatEvent.SecureHardwareNotAvailable)
         }
 
         override fun onDeveloperModeDetected() {
-            threatDispatcher.dispatchThreat(ThreatEvent.DevMode)
+            ThreatDispatcher.dispatchThreat(ThreatEvent.DevMode)
         }
 
         override fun onADBEnabledDetected() {
-            threatDispatcher.dispatchThreat(ThreatEvent.ADBEnabled)
+            ThreatDispatcher.dispatchThreat(ThreatEvent.ADBEnabled)
         }
 
         override fun onSystemVPNDetected() {
-            threatDispatcher.dispatchThreat(ThreatEvent.SystemVPN)
+            ThreatDispatcher.dispatchThreat(ThreatEvent.SystemVPN)
         }
     }
 
     private val raspExecutionState = object : ThreatListener.RaspExecutionState() {
         override fun onAllChecksFinished() {
-            executionStateDispatcher.dispatch(RaspExecutionStateEvent.AllChecksFinished)
+            ExecutionStateDispatcher.dispatch(RaspExecutionStateEvent.AllChecksFinished)
         }
     }
 
@@ -123,4 +116,4 @@ internal object PluginThreatHandler {
     internal fun unregisterSDKListener(context: Context) {
         internalListener.unregisterListener(context)
     }
-}
+}

package/android/src/main/java/com/aheaditec/freerasp/dispatchers/ExecutionStateDispatcher.kt

@@ -3,13 +3,15 @@ package com.aheaditec.freerasp.dispatchers
 import com.aheaditec.freerasp.events.RaspExecutionStateEvent
 import com.aheaditec.freerasp.interfaces.PluginExecutionStateListener
 
-internal class ExecutionStateDispatcher(private val listener: PluginExecutionStateListener) {
+internal object ExecutionStateDispatcher {
+    private lateinit var listener: PluginExecutionStateListener
     private val cache = mutableSetOf<RaspExecutionStateEvent>()
 
     private var isAppInForeground = false
     private var isListenerRegistered = false
 
-    fun registerListener() {
+    fun registerListener(newListener: PluginExecutionStateListener) {
+        listener = newListener
         isListenerRegistered = true
         isAppInForeground = true
         flushCache()

package/android/src/main/java/com/aheaditec/freerasp/dispatchers/ThreatDispatcher.kt

@@ -4,14 +4,16 @@ import com.aheaditec.talsec_security.security.api.SuspiciousAppInfo
 import com.aheaditec.freerasp.events.ThreatEvent
 import com.aheaditec.freerasp.interfaces.PluginThreatListener
 
-internal class ThreatDispatcher(private val listener: PluginThreatListener) {
+internal object ThreatDispatcher {
+    private lateinit var listener: PluginThreatListener
     private val threatCache = mutableSetOf<ThreatEvent>()
     private val malwareCache = mutableSetOf<SuspiciousAppInfo>()
 
     private var isAppInForeground = false
     private var isListenerRegistered = false
 
-    fun registerListener() {
+    fun registerListener(newListener: PluginThreatListener) {
+        listener = newListener
         isListenerRegistered = true
         isAppInForeground = true
         flushCache()

package/android/src/main/java/com/aheaditec/freerasp/models/CapSuspiciousAppInfo.kt

@@ -9,7 +9,7 @@ import kotlinx.serialization.Serializable
 @Serializable
 data class CapSuspiciousAppInfo(
     val packageInfo: CapPackageInfo,
-    val reason: String,
+    val reasons: Set<String>,
     val permissions: Set<String>?
 )
 

package/android/src/main/java/com/aheaditec/freerasp/utils/Extensions.kt

@@ -6,6 +6,10 @@ import android.util.Base64
 import android.util.Log
 import com.aheaditec.freerasp.models.CapPackageInfo
 import com.aheaditec.freerasp.models.CapSuspiciousAppInfo
+import com.aheaditec.talsec_security.security.api.MalwareScanScope
+import com.aheaditec.talsec_security.security.api.ReasonMode
+import com.aheaditec.talsec_security.security.api.ScopeType
+import com.aheaditec.talsec_security.security.api.SuspiciousAppDetectionConfig
 import com.aheaditec.talsec_security.security.api.SuspiciousAppInfo
 import com.getcapacitor.JSArray
 import kotlinx.serialization.encodeToString
@@ -50,13 +54,33 @@ internal fun JSONObject.getNestedArraySafe(key: String): Array<Array<String>> {
     return outArray.toTypedArray()
 }
 
+internal fun JSONObject.toScanScope(): MalwareScanScope {
+    val scopeType = ScopeType.valueOf(getString("scopeType"))
+    val trustedInstallSources = optJSONArray("trustedInstallSources")
+        ?.toPrimitiveArray<String>()?.toList()
+    return MalwareScanScope(scopeType, trustedInstallSources)
+}
+
+internal fun JSONObject.toSuspiciousAppDetectionConfig(): SuspiciousAppDetectionConfig {
+    val scanScope = getJSONObject("scanScope").toScanScope()
+    val reasonMode = ReasonMode.valueOf(getString("reasonMode"))
+    return SuspiciousAppDetectionConfig(
+        getArraySafe("packageNames").toSet().takeIf { it.isNotEmpty() },
+        getArraySafe("hashes").toSet().takeIf { it.isNotEmpty() },
+        getNestedArraySafe("requestedPermissions").map { it.toSet() }.toSet().takeIf { it.isNotEmpty() },
+        getNestedArraySafe("grantedPermissions").map { it.toSet() }.toSet().takeIf { it.isNotEmpty() },
+        scanScope,
+        reasonMode,
+    )
+}
+
 /**
  * Converts the Talsec's SuspiciousAppInfo to Capacitor equivalent
  */
 internal fun SuspiciousAppInfo.toCapSuspiciousAppInfo(context: Context): CapSuspiciousAppInfo {
     return CapSuspiciousAppInfo(
         packageInfo = this.packageInfo.toCapPackageInfo(context),
-        reason = this.reason,
+        reasons = this.reasons,
         permissions = this.permissions
     )
 }

package/android/src/main/java/com/aheaditec/freerasp/utils/RandomGenerator.kt

@@ -20,5 +20,4 @@ internal object RandomGenerator {
 
         return nextNumber
     }
-
-}
+}

package/dist/esm/api/methods/capacitor.d.ts

@@ -1,4 +1,4 @@
-import type { TalsecConfig, ThreatEventActions, RaspExecutionStateEventActions } from '../../types/types';
+import type { RaspExecutionStateEventActions, TalsecConfig, ThreatEventActions } from '../../types/types';
 export declare const startFreeRASP: (config: TalsecConfig, actions: ThreatEventActions, raspExecutionStateActions?: RaspExecutionStateEventActions) => Promise<{
     started: boolean;
 }>;

package/dist/esm/api/methods/capacitor.js

@@ -1,3 +1,4 @@
+import { withDefaults } from '../../utils/config';
 import { registerRaspExecutionStateListener } from '../listeners/raspExecutionState';
 import { registerThreatListener } from '../listeners/threat';
 import { Talsec } from '../nativeModules';
@@ -10,7 +11,7 @@ export const startFreeRASP = async (config, actions, raspExecutionStateActions)
     if (isRaspStarted) {
         return { started: true };
     }
-    const response = await Talsec.talsecStart({ config });
+    const response = await Talsec.talsecStart({ config: withDefaults(config) });
     isRaspStarted = true;
     return response;
 };

package/dist/esm/api/methods/capacitor.js.map

@@ -1 +1 @@
-{"version":3,"file":"capacitor.js","sourceRoot":"","sources":["../../../../src/api/methods/capacitor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kCAAkC,EAAE,MAAM,iCAAiC,CAAC;AACrF,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,IAAI,aAAa,GAAG,KAAK,CAAC;AAE1B,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,MAAoB,EACpB,OAA2B,EAC3B,yBAA0D,EAC3B,EAAE;IACjC,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,yBAAyB,EAAE,CAAC;QAC9B,MAAM,kCAAkC,CAAC,yBAAyB,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACtD,aAAa,GAAG,IAAI,CAAC;IAErB,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC","sourcesContent":["import type { TalsecConfig, ThreatEventActions, RaspExecutionStateEventActions } from '../../types/types';\nimport { registerRaspExecutionStateListener } from '../listeners/raspExecutionState';\nimport { registerThreatListener } from '../listeners/threat';\nimport { Talsec } from '../nativeModules';\n\nlet isRaspStarted = false;\n\nexport const startFreeRASP = async (\n  config: TalsecConfig,\n  actions: ThreatEventActions,\n  raspExecutionStateActions?: RaspExecutionStateEventActions,\n): Promise<{ started: boolean }> => {\n  await registerThreatListener(actions);\n  if (raspExecutionStateActions) {\n    await registerRaspExecutionStateListener(raspExecutionStateActions);\n  }\n  if (isRaspStarted) {\n    return { started: true };\n  }\n\n  const response = await Talsec.talsecStart({ config });\n  isRaspStarted = true;\n\n  return response;\n};\n"]}
+{"version":3,"file":"capacitor.js","sourceRoot":"","sources":["../../../../src/api/methods/capacitor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kCAAkC,EAAE,MAAM,iCAAiC,CAAC;AACrF,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,IAAI,aAAa,GAAG,KAAK,CAAC;AAE1B,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,MAAoB,EACpB,OAA2B,EAC3B,yBAA0D,EAC3B,EAAE;IACjC,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,yBAAyB,EAAE,CAAC;QAC9B,MAAM,kCAAkC,CAAC,yBAAyB,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5E,aAAa,GAAG,IAAI,CAAC;IAErB,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC","sourcesContent":["import type { RaspExecutionStateEventActions, TalsecConfig, ThreatEventActions } from '../../types/types';\nimport { withDefaults } from '../../utils/config';\nimport { registerRaspExecutionStateListener } from '../listeners/raspExecutionState';\nimport { registerThreatListener } from '../listeners/threat';\nimport { Talsec } from '../nativeModules';\n\nlet isRaspStarted = false;\n\nexport const startFreeRASP = async (\n  config: TalsecConfig,\n  actions: ThreatEventActions,\n  raspExecutionStateActions?: RaspExecutionStateEventActions,\n): Promise<{ started: boolean }> => {\n  await registerThreatListener(actions);\n  if (raspExecutionStateActions) {\n    await registerRaspExecutionStateListener(raspExecutionStateActions);\n  }\n  if (isRaspStarted) {\n    return { started: true };\n  }\n\n  const response = await Talsec.talsecStart({ config: withDefaults(config) });\n  isRaspStarted = true;\n\n  return response;\n};\n"]}

package/dist/esm/types/types.d.ts

@@ -61,21 +61,29 @@ export type TalsecAndroidConfig = {
     packageName: string;
     certificateHashes: string[];
     supportedAlternativeStores?: string[];
-    malwareConfig?: TalsecMalwareConfig;
+    suspiciousAppDetectionConfig?: SuspiciousAppDetectionConfig;
 };
 export type TalsecIosConfig = {
     appBundleId: string;
     appTeamId: string;
 };
-export type TalsecMalwareConfig = {
-    blacklistedHashes?: string[];
-    blacklistedPackageNames?: string[];
-    suspiciousPermissions?: string[][];
-    whitelistedInstallationSources?: string[];
+export type ScopeType = 'SIDELOADED_ONLY' | 'SIDELOADED_AND_SYSTEM_EXCLUDE_OEM' | 'SIDELOADED_AND_OEM' | 'SIDELOADED_AND_SYSTEM_AND_OEM' | 'ALL';
+export type ReasonMode = 'ALL' | 'HIGHEST_CONFIDENCE';
+export type ScanScope = {
+    scopeType: ScopeType;
+    trustedInstallSources?: string[];
+};
+export type SuspiciousAppDetectionConfig = {
+    packageNames?: string[];
+    hashes?: string[];
+    requestedPermissions?: string[][];
+    grantedPermissions?: string[][];
+    scanScope: ScanScope;
+    reasonMode: ReasonMode;
 };
 export type SuspiciousAppInfo = {
     packageInfo: PackageInfo;
-    reason: string;
+    reasons: string[];
     permissions?: string[];
 };
 export type PackageInfo = {

package/dist/esm/types/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/types/types.ts"],"names":[],"mappings":"","sourcesContent":["export interface TalsecPlugin {\n  talsecStart(options: { config: TalsecConfig }): Promise<{ started: boolean }>;\n  addListener(listener: string, callback: any): any;\n  onInvalidCallback(): void;\n  removeListenerForEvent(options: { eventName: string }): Promise<{ result: string }>;\n  getThreatIdentifiers(): Promise<{ ids: number[] }>;\n  getThreatChannelData(): Promise<{ ids: [string, string, string] }>;\n  getRaspExecutionStateIdentifiers(): Promise<{ ids: number[] }>;\n  getRaspExecutionStateChannelData(): Promise<{ ids: [string, string] }>;\n  storeExternalId(options: { data: string }): Promise<{ result: boolean }>;\n  removeExternalId(): Promise<{ result: boolean }>;\n  addToWhitelist(options: { packageName: string }): Promise<{ result: boolean }>;\n  blockScreenCapture(options: { enable: boolean }): Promise<{ result: boolean }>;\n  isScreenCaptureBlocked(): Promise<{ result: boolean }>;\n  getAppIcon(options: { packageName: string }): Promise<{ result: string }>;\n}\n\nexport type TalsecConfig = {\n  androidConfig?: TalsecAndroidConfig;\n  iosConfig?: TalsecIosConfig;\n  watcherMail: string;\n  isProd?: boolean;\n  killOnBypass?: boolean;\n};\n\nexport type TalsecAndroidConfig = {\n  packageName: string;\n  certificateHashes: string[];\n  supportedAlternativeStores?: string[];\n  malwareConfig?: TalsecMalwareConfig;\n};\n\nexport type TalsecIosConfig = {\n  appBundleId: string;\n  appTeamId: string;\n};\n\nexport type TalsecMalwareConfig = {\n  blacklistedHashes?: string[];\n  blacklistedPackageNames?: string[];\n  suspiciousPermissions?: string[][];\n  whitelistedInstallationSources?: string[];\n};\n\nexport type SuspiciousAppInfo = {\n  packageInfo: PackageInfo;\n  reason: string;\n  permissions?: string[];\n};\n\nexport type PackageInfo = {\n  packageName: string;\n  appName?: string;\n  version?: string;\n  appIcon?: string;\n  installerStore?: string;\n};\n\nexport type ThreatEventActions = {\n  privilegedAccess?: () => any;\n  debug?: () => any;\n  simulator?: () => any;\n  appIntegrity?: () => any;\n  unofficialStore?: () => any;\n  hooks?: () => any;\n  deviceBinding?: () => any;\n  deviceID?: () => any;\n  passcode?: () => any;\n  secureHardwareNotAvailable?: () => any;\n  obfuscationIssues?: () => any;\n  devMode?: () => any;\n  systemVPN?: () => any;\n  malware?: (suspiciousApps: SuspiciousAppInfo[]) => any;\n  adbEnabled?: () => any;\n  screenshot?: () => any;\n  screenRecording?: () => any;\n  multiInstance?: () => any;\n  timeSpoofing?: () => any;\n  locationSpoofing?: () => any;\n  unsecureWifi?: () => any;\n  automation?: () => any;\n};\n\nexport type NativeEvent = { [key: string]: number | string[] | undefined };\n\nexport type RaspExecutionStateEventActions = {\n  allChecksFinished?: () => any;\n};\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/types/types.ts"],"names":[],"mappings":"","sourcesContent":["export interface TalsecPlugin {\n  talsecStart(options: { config: TalsecConfig }): Promise<{ started: boolean }>;\n  addListener(listener: string, callback: any): any;\n  onInvalidCallback(): void;\n  removeListenerForEvent(options: { eventName: string }): Promise<{ result: string }>;\n  getThreatIdentifiers(): Promise<{ ids: number[] }>;\n  getThreatChannelData(): Promise<{ ids: [string, string, string] }>;\n  getRaspExecutionStateIdentifiers(): Promise<{ ids: number[] }>;\n  getRaspExecutionStateChannelData(): Promise<{ ids: [string, string] }>;\n  storeExternalId(options: { data: string }): Promise<{ result: boolean }>;\n  removeExternalId(): Promise<{ result: boolean }>;\n  addToWhitelist(options: { packageName: string }): Promise<{ result: boolean }>;\n  blockScreenCapture(options: { enable: boolean }): Promise<{ result: boolean }>;\n  isScreenCaptureBlocked(): Promise<{ result: boolean }>;\n  getAppIcon(options: { packageName: string }): Promise<{ result: string }>;\n}\n\nexport type TalsecConfig = {\n  androidConfig?: TalsecAndroidConfig;\n  iosConfig?: TalsecIosConfig;\n  watcherMail: string;\n  isProd?: boolean;\n  killOnBypass?: boolean;\n};\n\nexport type TalsecAndroidConfig = {\n  packageName: string;\n  certificateHashes: string[];\n  supportedAlternativeStores?: string[];\n  suspiciousAppDetectionConfig?: SuspiciousAppDetectionConfig;\n};\n\nexport type TalsecIosConfig = {\n  appBundleId: string;\n  appTeamId: string;\n};\n\nexport type ScopeType =\n  | 'SIDELOADED_ONLY'\n  | 'SIDELOADED_AND_SYSTEM_EXCLUDE_OEM'\n  | 'SIDELOADED_AND_OEM'\n  | 'SIDELOADED_AND_SYSTEM_AND_OEM'\n  | 'ALL';\n\nexport type ReasonMode = 'ALL' | 'HIGHEST_CONFIDENCE';\n\nexport type ScanScope = {\n  scopeType: ScopeType;\n  trustedInstallSources?: string[];\n};\n\nexport type SuspiciousAppDetectionConfig = {\n  packageNames?: string[];\n  hashes?: string[];\n  requestedPermissions?: string[][];\n  grantedPermissions?: string[][];\n  scanScope: ScanScope;\n  reasonMode: ReasonMode;\n};\n\nexport type SuspiciousAppInfo = {\n  packageInfo: PackageInfo;\n  reasons: string[];\n  permissions?: string[];\n};\n\nexport type PackageInfo = {\n  packageName: string;\n  appName?: string;\n  version?: string;\n  appIcon?: string;\n  installerStore?: string;\n};\n\nexport type ThreatEventActions = {\n  privilegedAccess?: () => any;\n  debug?: () => any;\n  simulator?: () => any;\n  appIntegrity?: () => any;\n  unofficialStore?: () => any;\n  hooks?: () => any;\n  deviceBinding?: () => any;\n  deviceID?: () => any;\n  passcode?: () => any;\n  secureHardwareNotAvailable?: () => any;\n  obfuscationIssues?: () => any;\n  devMode?: () => any;\n  systemVPN?: () => any;\n  malware?: (suspiciousApps: SuspiciousAppInfo[]) => any;\n  adbEnabled?: () => any;\n  screenshot?: () => any;\n  screenRecording?: () => any;\n  multiInstance?: () => any;\n  timeSpoofing?: () => any;\n  locationSpoofing?: () => any;\n  unsecureWifi?: () => any;\n  automation?: () => any;\n};\n\nexport type NativeEvent = { [key: string]: number | string[] | undefined };\n\nexport type RaspExecutionStateEventActions = {\n  allChecksFinished?: () => any;\n};\n"]}

package/dist/esm/utils/config.d.ts

@@ -0,0 +1,6 @@
+import type { ScanScope, ReasonMode, SuspiciousAppDetectionConfig, TalsecAndroidConfig, TalsecConfig } from '../types/types';
+export declare const DEFAULT_SCAN_SCOPE: ScanScope;
+export declare const DEFAULT_REASON_MODE: ReasonMode;
+export declare const withDetectionDefaults: (config: SuspiciousAppDetectionConfig) => SuspiciousAppDetectionConfig;
+export declare const normalizeAndroidConfig: (androidConfig: TalsecAndroidConfig) => TalsecAndroidConfig;
+export declare const withDefaults: (config: TalsecConfig) => TalsecConfig;

package/dist/esm/utils/config.js

@@ -0,0 +1,21 @@
+export const DEFAULT_SCAN_SCOPE = {
+    scopeType: 'SIDELOADED_ONLY',
+};
+export const DEFAULT_REASON_MODE = 'HIGHEST_CONFIDENCE';
+export const withDetectionDefaults = (config) => {
+    var _a, _b;
+    return (Object.assign(Object.assign({}, config), { scanScope: (_a = config.scanScope) !== null && _a !== void 0 ? _a : DEFAULT_SCAN_SCOPE, reasonMode: (_b = config.reasonMode) !== null && _b !== void 0 ? _b : DEFAULT_REASON_MODE }));
+};
+export const normalizeAndroidConfig = (androidConfig) => {
+    if (!androidConfig.suspiciousAppDetectionConfig) {
+        return androidConfig;
+    }
+    return Object.assign(Object.assign({}, androidConfig), { suspiciousAppDetectionConfig: withDetectionDefaults(androidConfig.suspiciousAppDetectionConfig) });
+};
+export const withDefaults = (config) => {
+    if (!config.androidConfig) {
+        return config;
+    }
+    return Object.assign(Object.assign({}, config), { androidConfig: normalizeAndroidConfig(config.androidConfig) });
+};
+//# sourceMappingURL=config.js.map

package/dist/esm/utils/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/utils/config.ts"],"names":[],"mappings":"AAQA,MAAM,CAAC,MAAM,kBAAkB,GAAc;IAC3C,SAAS,EAAE,iBAAiB;CAC7B,CAAC;AACF,MAAM,CAAC,MAAM,mBAAmB,GAAe,oBAAoB,CAAC;AAEpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAoC,EAAgC,EAAE;;IAAC,OAAA,iCACxG,MAAM,KACT,SAAS,EAAE,MAAA,MAAM,CAAC,SAAS,mCAAI,kBAAkB,EACjD,UAAU,EAAE,MAAA,MAAM,CAAC,UAAU,mCAAI,mBAAmB,IACpD,CAAA;CAAA,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,aAAkC,EAAuB,EAAE;IAChG,IAAI,CAAC,aAAa,CAAC,4BAA4B,EAAE,CAAC;QAChD,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,uCACK,aAAa,KAChB,4BAA4B,EAAE,qBAAqB,CAAC,aAAa,CAAC,4BAA4B,CAAC,IAC/F;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAoB,EAAgB,EAAE;IACjE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,uCACK,MAAM,KACT,aAAa,EAAE,sBAAsB,CAAC,MAAM,CAAC,aAAa,CAAC,IAC3D;AACJ,CAAC,CAAC","sourcesContent":["import type {\n  ScanScope,\n  ReasonMode,\n  SuspiciousAppDetectionConfig,\n  TalsecAndroidConfig,\n  TalsecConfig,\n} from '../types/types';\n\nexport const DEFAULT_SCAN_SCOPE: ScanScope = {\n  scopeType: 'SIDELOADED_ONLY',\n};\nexport const DEFAULT_REASON_MODE: ReasonMode = 'HIGHEST_CONFIDENCE';\n\nexport const withDetectionDefaults = (config: SuspiciousAppDetectionConfig): SuspiciousAppDetectionConfig => ({\n  ...config,\n  scanScope: config.scanScope ?? DEFAULT_SCAN_SCOPE,\n  reasonMode: config.reasonMode ?? DEFAULT_REASON_MODE,\n});\n\nexport const normalizeAndroidConfig = (androidConfig: TalsecAndroidConfig): TalsecAndroidConfig => {\n  if (!androidConfig.suspiciousAppDetectionConfig) {\n    return androidConfig;\n  }\n  return {\n    ...androidConfig,\n    suspiciousAppDetectionConfig: withDetectionDefaults(androidConfig.suspiciousAppDetectionConfig),\n  };\n};\n\nexport const withDefaults = (config: TalsecConfig): TalsecConfig => {\n  if (!config.androidConfig) {\n    return config;\n  }\n  return {\n    ...config,\n    androidConfig: normalizeAndroidConfig(config.androidConfig),\n  };\n};\n"]}

package/dist/esm/utils/malware.js

@@ -15,7 +15,7 @@ export const toSuspiciousAppInfo = (base64Value) => {
     const packageInfo = data.packageInfo;
     return {
         packageInfo,
-        reason: data.reason,
+        reasons: data.reasons,
         permissions: data.permissions,
     };
 };

package/dist/esm/utils/malware.js.map

@@ -1 +1 @@
-{"version":3,"file":"malware.js","sourceRoot":"","sources":["../../../src/utils/malware.ts"],"names":[],"mappings":"AAEA,4DAA4D;AAC5D,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,IAAc,EAAgC,EAAE;IACrF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1E,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,WAAmB,EAAqB,EAAE;IAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,WAA0B,CAAC;IACpD,OAAO;QACL,WAAW;QACX,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW;KACT,CAAC;AACzB,CAAC,CAAC","sourcesContent":["import type { PackageInfo, SuspiciousAppInfo } from '../types/types';\n\n// parses base64-encoded malware data to SuspiciousAppInfo[]\nexport const parseMalwareData = async (data: string[]): Promise<SuspiciousAppInfo[]> => {\n  return new Promise((resolve, reject) => {\n    try {\n      const suspiciousAppData = data.map((entry) => toSuspiciousAppInfo(entry));\n      resolve(suspiciousAppData);\n    } catch (error: any) {\n      reject(`Parsing app data failed: ${error}`);\n    }\n  });\n};\n\nexport const toSuspiciousAppInfo = (base64Value: string): SuspiciousAppInfo => {\n  const data = JSON.parse(atob(base64Value));\n  const packageInfo = data.packageInfo as PackageInfo;\n  return {\n    packageInfo,\n    reason: data.reason,\n    permissions: data.permissions,\n  } as SuspiciousAppInfo;\n};\n"]}
+{"version":3,"file":"malware.js","sourceRoot":"","sources":["../../../src/utils/malware.ts"],"names":[],"mappings":"AAEA,4DAA4D;AAC5D,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,IAAc,EAAgC,EAAE;IACrF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1E,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,WAAmB,EAAqB,EAAE;IAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,WAA0B,CAAC;IACpD,OAAO;QACL,WAAW;QACX,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;KACT,CAAC;AACzB,CAAC,CAAC","sourcesContent":["import type { PackageInfo, SuspiciousAppInfo } from '../types/types';\n\n// parses base64-encoded malware data to SuspiciousAppInfo[]\nexport const parseMalwareData = async (data: string[]): Promise<SuspiciousAppInfo[]> => {\n  return new Promise((resolve, reject) => {\n    try {\n      const suspiciousAppData = data.map((entry) => toSuspiciousAppInfo(entry));\n      resolve(suspiciousAppData);\n    } catch (error: any) {\n      reject(`Parsing app data failed: ${error}`);\n    }\n  });\n};\n\nexport const toSuspiciousAppInfo = (base64Value: string): SuspiciousAppInfo => {\n  const data = JSON.parse(atob(base64Value));\n  const packageInfo = data.packageInfo as PackageInfo;\n  return {\n    packageInfo,\n    reasons: data.reasons,\n    permissions: data.permissions,\n  } as SuspiciousAppInfo;\n};\n"]}

package/dist/plugin.cjs.js

@@ -174,7 +174,7 @@ const toSuspiciousAppInfo = (base64Value) => {
     const packageInfo = data.packageInfo;
     return {
         packageInfo,
-        reason: data.reason,
+        reasons: data.reasons,
         permissions: data.permissions,
     };
 };
@@ -362,6 +362,27 @@ const removeRaspExecutionStateListener = async () => {
     await Talsec.removeListenerForEvent({ eventName: executionStateChannel });
 };
 
+const DEFAULT_SCAN_SCOPE = {
+    scopeType: 'SIDELOADED_ONLY',
+};
+const DEFAULT_REASON_MODE = 'HIGHEST_CONFIDENCE';
+const withDetectionDefaults = (config) => {
+    var _a, _b;
+    return (Object.assign(Object.assign({}, config), { scanScope: (_a = config.scanScope) !== null && _a !== void 0 ? _a : DEFAULT_SCAN_SCOPE, reasonMode: (_b = config.reasonMode) !== null && _b !== void 0 ? _b : DEFAULT_REASON_MODE }));
+};
+const normalizeAndroidConfig = (androidConfig) => {
+    if (!androidConfig.suspiciousAppDetectionConfig) {
+        return androidConfig;
+    }
+    return Object.assign(Object.assign({}, androidConfig), { suspiciousAppDetectionConfig: withDetectionDefaults(androidConfig.suspiciousAppDetectionConfig) });
+};
+const withDefaults = (config) => {
+    if (!config.androidConfig) {
+        return config;
+    }
+    return Object.assign(Object.assign({}, config), { androidConfig: normalizeAndroidConfig(config.androidConfig) });
+};
+
 let isRaspStarted = false;
 const startFreeRASP = async (config, actions, raspExecutionStateActions) => {
     await registerThreatListener(actions);
@@ -371,7 +392,7 @@ const startFreeRASP = async (config, actions, raspExecutionStateActions) => {
     if (isRaspStarted) {
         return { started: true };
     }
-    const response = await Talsec.talsecStart({ config });
+    const response = await Talsec.talsecStart({ config: withDefaults(config) });
     isRaspStarted = true;
     return response;
 };