freerasp-react-native 4.5.2 → 5.1.0

package/CHANGELOG.md

@@ -5,6 +5,70 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.1.0]
+
+- Android SDK version: 18.3.0
+- iOS SDK version: 7.1.0
+
+### React Native
+
+#### Fixed
+
+- Fixed identifier retrieval after React Native context reinitialization ([#152](https://github.com/talsec/Free-RASP-ReactNative/issues/152)).
+
+#### Added
+
+- Added Swift Package Manager delivery of `TalsecRuntime`, enabled by default for Expo projects and available as an opt-in for bare React Native 0.75 or newer projects.
+- Added the Expo config plugin option `ios.useSpm`; set it to `false` to use the vendored XCFramework fallback.
+
+### iOS
+
+#### Added
+
+- Added support for postponed checks, therefore, due to slower execution, some subchecks are run after initial startup checks.
+- Improved hook detection.
+
+#### Fixed
+
+- Fixed issue with app's color scheme initialization.
+- Fixed bad memory access in jaibreak check.
+
+## [5.0.0] - 2026-05-15
+
+- Android SDK version: 18.3.0
+- iOS SDK version: 6.14.4
+
+### Breaking
+
+- `SuspiciousAppInfo.reason` (String) renamed to `reasons` (string[])
+- Value `"blacklist"` in `reasons` renamed to `"blocklist"`
+- Removed `MalwareConfig` and `AndroidConfig.malwareConfig`
+
+### React Native
+
+#### Removed
+
+- `TalsecMalwareConfig` type and `TalsecAndroidConfig.malwareConfig` field
+
+### Android
+
+#### Added
+
+- New API class `SuspiciousAppDetectionConfig` that can be used to configure malware detection
+- New API for malware detection configuration in `TalsecConfig`, see `TalsecConfig.Builder#suspiciousAppDetection`
+
+#### Fixed
+
+- Fixed `VerifyError` caused by `JaCoCo` bytecode instrumentation
+- Fixed a potential cause of crash in the multi-instance detector
+- Fixed Java interoperability of `ScreenProtector` methods
+- Fixed Kotlin classpath conflicts in SDK dependency resolution (Kotlin 2.0.0)
+
+#### Changed
+
+- Fine-tuned location spoofing detection
+- Modified malware incident log structure for better aggregation
+
 ## [4.5.2] - 2026-03-24
 
 - Android SDK version: 18.0.4

package/android/build.gradle

@@ -105,7 +105,7 @@ dependencies {
   implementation "com.facebook.react:react-native:$react_native_version"
   implementation "org.jetbrains.kotlin:kotlin-stdlib:$kotlin_version"
   implementation "org.jetbrains.kotlinx:kotlinx-serialization-json:1.4.1"
-  implementation "com.aheaditec.talsec.security:TalsecSecurity-Community-ReactNative:18.0.4"
+  implementation "com.aheaditec.talsec.security:TalsecSecurity-Community-ReactNative:18.3.0"
 }
 
 if (isNewArchitectureEnabled()) {

package/android/src/main/java/com/freeraspreactnative/FreeraspReactNativeModule.kt

@@ -33,6 +33,7 @@ import com.freeraspreactnative.utils.getMapThrowing
 import com.freeraspreactnative.utils.getNestedArraySafe
 import com.freeraspreactnative.utils.getStringThrowing
 import com.freeraspreactnative.utils.toEncodedWritableArray
+import com.freeraspreactnative.utils.toSuspiciousAppDetectionConfig
 
 class FreeraspReactNativeModule(private val reactContext: ReactApplicationContext) :
   ReactContextBaseJavaModule(reactContext) {
@@ -107,8 +108,8 @@ class FreeraspReactNativeModule(private val reactContext: ReactApplicationContex
 
   // Trigger lazy initialization of the freeRASP events
   private fun initializeEventKeys() {
-    ThreatEvent.ALL_EVENTS
-    RaspExecutionStateEvent.ALL_EVENTS
+    ThreatEvent.ALL_EVENT_IDENTIFIERS
+    RaspExecutionStateEvent.ALL_EVENT_IDENTIFIERS
   }
 
   /**
@@ -116,7 +117,9 @@ class FreeraspReactNativeModule(private val reactContext: ReactApplicationContex
    */
   @ReactMethod
   fun getThreatIdentifiers(promise: Promise) {
-    promise.resolve(ThreatEvent.ALL_EVENTS)
+    promise.resolve(
+      Arguments.fromList(ThreatEvent.ALL_EVENT_IDENTIFIERS)
+    )
   }
 
   /**
@@ -124,7 +127,9 @@ class FreeraspReactNativeModule(private val reactContext: ReactApplicationContex
    */
   @ReactMethod
   fun getRaspExecutionStateIdentifiers(promise: Promise) {
-    promise.resolve(RaspExecutionStateEvent.ALL_EVENTS)
+    promise.resolve(
+      Arguments.fromList(RaspExecutionStateEvent.ALL_EVENT_IDENTIFIERS)
+    )
   }
 
   /**
@@ -298,12 +303,9 @@ class FreeraspReactNativeModule(private val reactContext: ReactApplicationContex
       .killOnBypass(config.getBooleanSafe("killOnBypass", false))
       .supportedAlternativeStores(androidConfig.getArraySafe("supportedAlternativeStores"))
 
-    if (androidConfig.hasKey("malwareConfig")) {
-      val malwareConfig = androidConfig.getMapThrowing("malwareConfig")
-      talsecBuilder.whitelistedInstallationSources(malwareConfig.getArraySafe("whitelistedInstallationSources"))
-      talsecBuilder.blacklistedHashes(malwareConfig.getArraySafe("blacklistedHashes"))
-      talsecBuilder.blacklistedPackageNames(malwareConfig.getArraySafe("blacklistedPackageNames"))
-      talsecBuilder.suspiciousPermissions(malwareConfig.getNestedArraySafe("suspiciousPermissions"))
+    if (androidConfig.hasKey("suspiciousAppDetectionConfig")) {
+      val suspiciousAppConfig = androidConfig.getMapThrowing("suspiciousAppDetectionConfig")
+      talsecBuilder.suspiciousAppDetection(suspiciousAppConfig.toSuspiciousAppDetectionConfig())
     }
 
     return talsecBuilder.build()

package/android/src/main/java/com/freeraspreactnative/events/RaspExecutionStateEvent.kt

@@ -1,6 +1,5 @@
 package com.freeraspreactnative.events
 
-import com.facebook.react.bridge.Arguments
 import com.freeraspreactnative.utils.RandomGenerator
 
 internal sealed class RaspExecutionStateEvent(override val value: Int) : BaseRaspEvent {
@@ -12,9 +11,8 @@ internal sealed class RaspExecutionStateEvent(override val value: Int) : BaseRas
   companion object Companion {
     internal val CHANNEL_NAME = RandomGenerator.next().toString()
     internal val CHANNEL_KEY = RandomGenerator.next().toString()
-    internal val ALL_EVENTS = Arguments.fromList(
-      listOf(
-        AllChecksFinished
-      ).map { it.value })
+    internal val ALL_EVENT_IDENTIFIERS = listOf(
+      AllChecksFinished
+    ).map { it.value }
   }
 }

package/android/src/main/java/com/freeraspreactnative/events/ThreatEvent.kt

@@ -1,6 +1,5 @@
 package com.freeraspreactnative.events
 
-import com.facebook.react.bridge.Arguments
 import com.freeraspreactnative.utils.RandomGenerator
 
 /**
@@ -41,29 +40,28 @@ internal sealed class ThreatEvent(override val value: Int) : BaseRaspEvent {
     internal val CHANNEL_KEY = RandomGenerator.next().toString()
     internal val MALWARE_CHANNEL_KEY = RandomGenerator.next().toString()
 
-    internal val ALL_EVENTS = Arguments.fromList(
-      listOf(
-        AppIntegrity,
-        PrivilegedAccess,
-        Debug,
-        Hooks,
-        Passcode,
-        Simulator,
-        SecureHardwareNotAvailable,
-        SystemVPN,
-        DeviceBinding,
-        UnofficialStore,
-        ObfuscationIssues,
-        DevMode,
-        Malware,
-        ADBEnabled,
-        Screenshot,
-        ScreenRecording,
-        MultiInstance,
-        TimeSpoofing,
-        LocationSpoofing,
-        UnsecureWifi,
-        Automation
-      ).map { it.value })
+    internal val ALL_EVENT_IDENTIFIERS = listOf(
+      AppIntegrity,
+      PrivilegedAccess,
+      Debug,
+      Hooks,
+      Passcode,
+      Simulator,
+      SecureHardwareNotAvailable,
+      SystemVPN,
+      DeviceBinding,
+      UnofficialStore,
+      ObfuscationIssues,
+      DevMode,
+      Malware,
+      ADBEnabled,
+      Screenshot,
+      ScreenRecording,
+      MultiInstance,
+      TimeSpoofing,
+      LocationSpoofing,
+      UnsecureWifi,
+      Automation
+    ).map { it.value }
   }
 }

package/android/src/main/java/com/freeraspreactnative/models/RNSuspiciousAppInfo.kt

@@ -9,7 +9,7 @@ import kotlinx.serialization.Serializable
 @Serializable
 data class RNSuspiciousAppInfo(
   val packageInfo: RNPackageInfo,
-  val reason: String,
+  val reasons: Set<String>,
   val permissions: Set<String>?
 )
 

package/android/src/main/java/com/freeraspreactnative/utils/Extensions.kt

@@ -3,6 +3,10 @@ package com.freeraspreactnative.utils
 import android.content.pm.PackageInfo
 import android.util.Base64
 import android.util.Log
+import com.aheaditec.talsec_security.security.api.MalwareScanScope
+import com.aheaditec.talsec_security.security.api.ReasonMode
+import com.aheaditec.talsec_security.security.api.ScopeType
+import com.aheaditec.talsec_security.security.api.SuspiciousAppDetectionConfig
 import com.aheaditec.talsec_security.security.api.SuspiciousAppInfo
 import com.facebook.react.bridge.Arguments
 import com.facebook.react.bridge.ReactContext
@@ -32,7 +36,7 @@ internal fun ReadableMap.getBooleanSafe(key: String, defaultValue: Boolean = tru
   return defaultValue
 }
 
-private inline fun <reified T> ReadableArray.toPrimitiveArray(): Array<T> {
+internal inline fun <reified T> ReadableArray.toPrimitiveArray(): Array<T> {
   val output = mutableListOf<T>()
 
   for (i in 0 until this.size()) {
@@ -74,7 +78,7 @@ internal fun ReadableMap.getNestedArraySafe(key: String): Array<Array<String>> {
 internal fun SuspiciousAppInfo.toRNSuspiciousAppInfo(context: ReactContext): RNSuspiciousAppInfo {
   return RNSuspiciousAppInfo(
     packageInfo = this.packageInfo.toRNPackageInfo(context),
-    reason = this.reason,
+    reasons = this.reasons,
     permissions = this.permissions
   )
 }
@@ -92,6 +96,22 @@ internal fun PackageInfo.toRNPackageInfo(context: ReactContext): RNPackageInfo {
   )
 }
 
+internal fun ReadableMap.toScanScope(): MalwareScanScope {
+  val scopeType = ScopeType.valueOf(getStringThrowing("scopeType"))
+  val trustedInstallSources = getArraySafe("trustedInstallSources").toList().ifEmpty { null }
+  return MalwareScanScope(scopeType, trustedInstallSources)
+}
+
+internal fun ReadableMap.toSuspiciousAppDetectionConfig(): SuspiciousAppDetectionConfig {
+  val packageNames = getArraySafe("packageNames").toSet().ifEmpty { null }
+  val hashes = getArraySafe("hashes").toSet().ifEmpty { null }
+  val requestedPermissions = getNestedArraySafe("requestedPermissions").map { it.toSet() }.toSet().ifEmpty { null }
+  val grantedPermissions = getNestedArraySafe("grantedPermissions").map { it.toSet() }.toSet().ifEmpty { null }
+  val scanScope = getMapThrowing("scanScope").toScanScope()
+  val reasonMode = ReasonMode.valueOf(getStringThrowing("reasonMode"))
+  return SuspiciousAppDetectionConfig(packageNames, hashes, requestedPermissions, grantedPermissions, scanScope, reasonMode)
+}
+
 /**
  * Convert the Talsec's SuspiciousAppInfo to base64-encoded json array,
  * which can be then sent to React Native

package/freerasp-react-native.podspec

@@ -3,6 +3,8 @@ require "json"
 package = JSON.parse(File.read(File.join(__dir__, "package.json")))
 folly_compiler_flags = '-DFOLLY_NO_CONFIG -DFOLLY_MOBILE=1 -DFOLLY_USE_LIBCPP=1 -Wno-comma -Wno-shorten-64-to-32'
 
+talsec_spm_path = File.expand_path('ios/TalsecRuntimePackage', __dir__)
+
 Pod::Spec.new do |s|
   s.name         = "freerasp-react-native"
   s.version      = package["version"]
@@ -14,14 +16,35 @@ Pod::Spec.new do |s|
   s.platforms    = { :ios => "11.0" }
   s.source       = { :git => "https://github.com/talsec/freerasp-react-native.git", :tag => "#{s.version}" }
 
-  s.source_files = 'ios/models/*.{h,m,mm,swift}', 
-                   'ios/utils/*.{h,m,mm,swift}', 
-                   'ios/dispatchers/*.{h,m,mm,swift}', 
-                   'ios/*.{h,m,mm,swift}', 
-                   'ios/TalsecRuntime.xcframework'
-  s.xcconfig = { 'OTHER_LDFLAGS' => '-framework TalsecRuntime' }
-  s.ios.vendored_frameworks = "ios/TalsecRuntime.xcframework"
-  
+  spm_requested = ENV['FREERASP_USE_SPM'] == '1'
+  use_spm = spm_requested && respond_to?(:spm_dependency, true)
+
+  if spm_requested && !respond_to?(:spm_dependency, true)
+    Pod::UI.warn '[freeRASP][SPM] React Native does not provide spm_dependency; using the vendored TalsecRuntime framework.'
+  end
+
+  source_globs = [
+    'ios/models/*.{h,m,mm,swift}',
+    'ios/utils/*.{h,m,mm,swift}',
+    'ios/dispatchers/*.{h,m,mm,swift}',
+    'ios/*.{h,m,mm,swift}',
+  ]
+
+  if use_spm
+    s.ios.deployment_target = '13.0'
+    spm_dependency(s,
+      url: talsec_spm_path,
+      requirement: {},
+      products: ['TalsecRuntime']
+    )
+  else
+    source_globs << 'ios/TalsecRuntime.xcframework'
+    s.xcconfig = { 'OTHER_LDFLAGS' => '-framework TalsecRuntime' }
+    s.ios.vendored_frameworks = 'ios/TalsecRuntime.xcframework'
+  end
+
+  s.source_files = source_globs
+
   # Use install_modules_dependencies helper to install the dependencies if React Native version >=0.71.0.
   # See https://github.com/facebook/react-native/blob/febf6b7f33fdb4904669f99d795eba4c0f95d7bf/scripts/cocoapods/new_architecture.rb#L79.
   if respond_to?(:install_modules_dependencies, true)

package/freerasp_spm.rb

@@ -0,0 +1,88 @@
+# Links and embeds the local TalsecRuntime Swift package.
+
+def freerasp_embed_talsec_spm!(installer,
+  package_path: File.expand_path('ios/TalsecRuntimePackage', __dir__),
+  product: 'TalsecRuntime')
+
+  package_path = File.expand_path(package_path)
+  local_pkg_class = Xcodeproj::Project::Object::XCLocalSwiftPackageReference
+  remote_pkg_class = Xcodeproj::Project::Object::XCRemoteSwiftPackageReference
+  ref_class = Xcodeproj::Project::Object::XCSwiftPackageProductDependency
+
+  spm_active = ENV['FREERASP_USE_SPM'] == '1' &&
+    respond_to?(:spm_dependency, true)
+
+  if spm_active && !File.file?(File.join(package_path, 'Package.swift'))
+    raise Pod::Informative, "[freeRASP][SPM] Package.swift not found at #{package_path}"
+  end
+
+  projects_and_targets = {}
+  pods_project = installer.pods_project
+  projects_and_targets[pods_project] = pods_project.targets.select do |target|
+    target.name == 'freerasp-react-native'
+  end
+
+  installer.aggregate_targets.each do |aggregate_target|
+    project = aggregate_target.user_project
+    next if project.nil?
+
+    app_targets = aggregate_target.user_targets.select do |t|
+      t.respond_to?(:product_type) && t.product_type == 'com.apple.product-type.application'
+    end
+    projects_and_targets[project] ||= []
+    projects_and_targets[project].concat(app_targets)
+  end
+
+  new_object = lambda do |project, klass|
+    uuid = project.generate_uuid
+    uuid = project.generate_uuid while project.objects_by_uuid.key?(uuid)
+    object = klass.new(project, uuid)
+    object.initialize_defaults
+    object
+  end
+
+  projects_and_targets.each do |project, targets|
+    targets.uniq!
+
+    # Remove existing references before recreating them.
+    owned_packages = []
+    targets.each do |target|
+      target.package_product_dependencies.select do |reference|
+        reference.class == ref_class && reference.product_name == product
+      end.each do |reference|
+        owned_packages << reference.package unless reference.package.nil?
+        reference.remove_from_project
+      end
+    end
+    project.root_object.package_references.each do |package|
+      reference_path =
+        if package.class == local_pkg_class
+          package.relative_path
+        elsif package.class == remote_pkg_class
+          package.repositoryURL
+        end
+      next if reference_path.nil?
+
+      owned_packages << package if File.basename(reference_path) == 'TalsecRuntimePackage'
+    end
+    owned_packages.uniq.each do |package|
+      package.remove_from_project
+    end
+
+    if spm_active
+      pkg = new_object.call(project, local_pkg_class)
+      pkg.relative_path = package_path
+      project.root_object.package_references << pkg
+
+      targets.each do |target|
+        Pod::UI.puts "[freeRASP][SPM] Linking #{product} to target #{target.name}"
+        dep = new_object.call(project, ref_class)
+        dep.package = pkg
+        dep.product_name = product
+        target.package_product_dependencies << dep
+      end
+    end
+
+    project.save
+  end
+end

package/ios/TalsecRuntime.xcframework/Info.plist

@@ -8,32 +8,32 @@
 			<key>BinaryPath</key>
 			<string>TalsecRuntime.framework/TalsecRuntime</string>
 			<key>LibraryIdentifier</key>
-			<string>ios-arm64_x86_64-simulator</string>
+			<string>ios-arm64</string>
 			<key>LibraryPath</key>
 			<string>TalsecRuntime.framework</string>
 			<key>SupportedArchitectures</key>
 			<array>
 				<string>arm64</string>
-				<string>x86_64</string>
 			</array>
 			<key>SupportedPlatform</key>
 			<string>ios</string>
-			<key>SupportedPlatformVariant</key>
-			<string>simulator</string>
 		</dict>
 		<dict>
 			<key>BinaryPath</key>
 			<string>TalsecRuntime.framework/TalsecRuntime</string>
 			<key>LibraryIdentifier</key>
-			<string>ios-arm64</string>
+			<string>ios-arm64_x86_64-simulator</string>
 			<key>LibraryPath</key>
 			<string>TalsecRuntime.framework</string>
 			<key>SupportedArchitectures</key>
 			<array>
 				<string>arm64</string>
+				<string>x86_64</string>
 			</array>
 			<key>SupportedPlatform</key>
 			<string>ios</string>
+			<key>SupportedPlatformVariant</key>
+			<string>simulator</string>
 		</dict>
 	</array>
 	<key>CFBundlePackageType</key>