Audit: iOS bugs, Expo plugin fragility, dead CI

[am-koan]

Audit Findings — 2026-04-11

Code quality and correctness audit of iOS native layer, Expo config plugin, and CI. This complements the Android fixes in PR #5.

High Priority

• iOS pauseUnity: takes BOOL * instead of BOOL — same bug as Android (PR fix(android): resolve black screen and improve reliability #5). Method always pauses, never unpauses. resumeUnity casts literal false to BOOL * (null pointer violation that accidentally works). Files: RNUnityView.h:34, RNUnityView.mm:93, RNUnityViewManager.mm:66
• Memory leak in iOS initUnityModule — malloc/strdup allocations never freed after runEmbeddedWithArgc:argv:appLaunchOpts:. File: RNUnityView.mm:55-62
• CircleCI config uses Node 10 (EOL 2021, package.json requires >=18). Dead pipeline. File: .circleci/config.yml:5

Medium Priority

• iOS exported methods use global unity instead of resolved view — postMessage/pauseUnity/unloadUnity resolve view from viewRegistry, validate it, then call methods on a file-global variable. Stale instance risk. File: RNUnityViewManager.mm:16,37-78
• Static singleton view refs on both platforms — ReactNativeUnityViewManager.view (Android) and unity (iOS) are static/global. Multiple createViewInstance overwrites, callbacks close over stale reference.
• onPlayerUnload called with nil — RCTBubblingEventBlock expects a dictionary. File: RNUnityView.mm:126
• componentWillUnmount always unloads Unity — ignores androidKeepPlayerMounted, forces expensive reinit. File: UnityView.tsx:68-72
• Expo plugin withSettingsGradleMod appends unconditionally — duplicate entries on multiple prebuilds. File: app.plugin.js:43
• Expo plugin depends on exact jitpack marker string — breaks on Expo SDK upgrades. File: app.plugin.js:22
• Zero test coverage — only it.todo('write a test') exists

Low Priority

• Dead code: sharedInstance declared never used (RNUnityView.mm:39)
• appLaunchOpts always nil (RNUnityView.mm:37)
• GitHub Actions uses deprecated actions/checkout@v3 / actions/cache@v3

Notes

• No security vulnerabilities found
• No secrets in source code
• 3 of the Android-side findings were already addressed in PR fix(android): resolve black screen and improve reliability #5

---

🤖 Created by Kōan from audit session

[am-koan]

Additional Findings — 2026-04-13 (Session 6: Full-Stack Audit)

Deep audit of JS/TS layer, Android native code, build configuration, New Architecture support, and dependency health. Complements the original iOS/Expo findings above.

High Priority (NEW)

• Android pauseUnity ignores the pause parameter — ReactNativeUnityViewManager.java:140 always calls getPlayer().pause(), never branches on the boolean. Same user-facing bug as the iOS BOOL/BOOL* issue, different root cause.
• Thread.sleep(1000) on the UI thread — ReactNativeUnity.java:57 blocks the main thread for 1 full second inside runOnUiThread. This freezes the app during Unity init and risks ANR on slower devices. Should use Handler.postDelayed().
• Fragile constructor selection in UPlayer — UPlayer.java:27 uses getConstructors()[1] (hardcoded index). Constructor order is not guaranteed by the JVM spec. Different Unity versions or R8 optimization can silently break this. Should find by parameter types instead.
• 6+ silently swallowed exceptions in ReactNativeUnityViewManager.java:54,79 and ReactNativeUnity.java:54,64,70,82. If Unity player creation fails, execution continues on null references → cascading silent failures.
• iOS Fabric: only onUnityMessage event is wired — RNUnityView.mm:181-189 connects onUnityMessage to the C++ event emitter but not onPlayerUnload or onPlayerQuit. On New Architecture, unload/quit events will silently never fire.

Medium Priority (NEW)

• Example app depends on wrong package — example/package.json:13 references @azesmway/react-native-unity@^0.4.0 (the upstream npm package) instead of the local @artmajeur/react-native-unity. The example doesn't actually use the fork's code.
• Podspec source URL points to upstream — react-native-unity.podspec:15 references azesmway/react-native-unity.git. CocoaPods will fetch from upstream, not the fork.
• jcenter() in build.gradle — android/build.gradle:101. JCenter was sunset Feb 2023 (read-only). Dependencies may become unavailable.
• Expo plugin arm64 exclusion breaks Apple Silicon simulators — app.plugin.js:98-101. EXCLUDED_ARCHS[sdk=iphonesimulator*]" = "arm64" was for Intel Macs; actively harmful on M1+ with Xcode 14+.
• Fabric prepareForRecycle kills Unity — RNUnityView.mm:157-170. View recycling unloads the entire singleton Unity runtime, defeating keepPlayerMounted.
• GitHub Actions on deprecated @V3 (Node 16 EOL) — all actions in .github/workflows/ci.yml and .github/actions/setup/action.yml.

Low Priority (NEW)

• lefthook.yml:10 — glob "*.{js,ts, jsx, tsx}" has spaces that may prevent matching
• UnityViewNativeComponent.ts / UnityView.tsx — duplicate UnityViewContentUpdateEvent type
• UnityView.tsx:62-66 — getProps() is a no-op spread
• example/package.json — ~10 unused devDependencies (@types/i18n-js, @types/lodash, etc.)
• Root package.json — significantly outdated devDependencies (types/react 17, prettier 2, eslint 8)

---

🤖 Full-stack audit by Kōan — session 6

[am-koan]

Additional Findings — 2026-04-16 (Session 7: Dependency, Secrets & CI Audit)

Focused on areas not yet covered: dependency health, secrets scanning, CI/CD security posture, npm package boundaries, and open PR review.

Medium Priority (NEW)

• No security scanning in CI — .github/workflows/ci.yml has lint, typecheck, test, and build jobs but zero dependency vulnerability scanning. No npm audit, no yarn audit, no SAST. A yarn npm audit --severity moderate step should be added to the CI pipeline.

Low Priority (NEW)

• Google Maps API key committed — example/android/app/src/main/AndroidManifest.xml:74 contains AIzaSyD_XHpYQ8QGYUYnVldanNhhVreAaxk3S9s. While Maps keys are typically app-restricted, this one is in a public repo with no documented restrictions. Could be abused for quota exhaustion. Should use BuildConfig or a gitignored local properties file.
• Example app requests 16+ permissions — includes SYSTEM_ALERT_WINDOW, READ_PHONE_STATE, WRITE_EXTERNAL_STORAGE (deprecated in API 30+), DOWNLOAD_WITHOUT_NOTIFICATION. Excessive for a Unity view demo. Sets a bad example for consumers of the library.
• Example app compileSdkVersion=33 — Google Play requires target SDK 34+ since Aug 2024. Should update to 34 or 35.
• Example release builds use debug keystore — example/android/app/build.gradle signs release builds with the default debug keystore. Proguard also disabled.

Verified Clean

• ✅ No secrets in library source code — comprehensive scan of all non-vendor files
• ✅ No production keystores committed — only example/android/app/debug.keystore (standard RN default)
• ✅ Yarn lockfile present with integrity checksums — yarn.lock uses Yarn 3 format with SHA checksums
• ✅ npm publish scope correct — files field in package.json limits published content to src/, lib/, android/, ios/, cpp/, unity/, app.plugin.js, *.podspec. Example app, CI configs, and dev files excluded.
• ✅ No google-services.json committed — Firebase config properly gitignored
• ✅ Gradle wrapper downloads from services.gradle.org over HTTPS
• ✅ scripts/pod-install.cjs uses shell: true but with hardcoded args (no injection risk)

Open PR Security Review

Reviewed all 7 open upstream PRs (azesmway#126, azesmway#153, azesmway#161, azesmway#164, azesmway#173, azesmway#174, azesmway#176):

• No security vulnerabilities found in any PR
• PR Expo Config Plugin fix - use app.plugin.js to fix Typescript issues azesmway/react-native-unity#126 (already merged into fork as app.plugin.js) has idempotency issues (documented above as "withSettingsGradleMod appends unconditionally")
• PR Add an iOS withDangerousMod to the Expo config plugin that patches RCTThirdPartyComponentsProvider.mm azesmway/react-native-unity#176 has better defensive coding than Expo Config Plugin fix - use app.plugin.js to fix Typescript issues azesmway/react-native-unity#126 (checks for existing patches before applying)
• PR Add Unity post-processing build scripts for iOS and Android azesmway/react-native-unity#161 (build scripts) uses safe Unity APIs — no path traversal or injection risks

Cumulative Issue Summary

After 4 audit sessions: 5 HIGH, 9 MEDIUM, 9 LOW, 2 INFO across the entire codebase. The fork's PR #5 addresses some Android HIGH items. No new HIGH or CRITICAL findings in this session.

---

🤖 Dependencies & CI audit by Kōan — session 7

[am-koan]

Additional Findings — 2026-04-16 (Session 9: JS API, Message Bridge & Expo Plugin Deep Review)

Focused review of the JS/TS public API surface, native message bridge security posture, Fabric event lifecycle, and Expo config plugin logic.

Medium Priority (NEW)

• Expo plugin clobbers app name — app.plugin.js:13 — config.name = name overwrites the Expo app's display name with 'react-native-unity' (default parameter). Any app using this plugin without passing { name: "..." } silently has its name changed. The plugin should not modify config.name at all — this parameter appears to be a mistake from the original authoring.

Low Priority (NEW)

• All 4 Expo plugin mods lack idempotency, not just settings.gradle — withProjectBuildGradleMod (app.plugin.js:26-28) uses String.replace() on the first match of the jitpack marker, re-inserting the flatDir line on each prebuild. withPodfileDangerousMod (app.plugin.js:97-103) similarly re-inserts the arm64 exclusion block. withGradlePropertiesMod (app.plugin.js:52) pushes a duplicate unityStreamingAssets property. Only withStringsXMLMod is safe (Android string resources handle dedup).
• Fabric C++ lambda captures raw self pointer — RNUnityView.mm:181 — [self](NSDictionary* data) { ... } captures self as a raw pointer in the C++ lambda stored as onUnityMessage. On view recycling, prepareForRecycle (line 157) unloads Unity but never nils out the event handler. If Unity fires a late sendMessageToMobileApp during or after recycling, the lambda dereferences stale _eventEmitter → undefined behavior.
• tsconfig.json path alias references upstream package — tsconfig.json:5 — maps @azesmway/react-native-unity instead of @artmajeur/react-native-unity. IDE tooling resolves the old upstream import path, not the fork's published name.
• NativeCallProxy global api retains view indefinitely — NativeCallProxy.mm:6 — id<NativeCallsProtocol> api = NULL is ARC strong by default. Never cleared on unload (unityDidUnload sets ufw = nil but not api). View cannot be deallocated while the global holds it. Minor lifecycle issue in the singleton model, but prevents proper cleanup.

Security Assessment

Performed targeted review of the JS ↔ Unity message bridge (both platforms):

• postMessage (JS → Native → Unity): parameters pass through as-is to UnityPlayer.UnitySendMessage(). No validation, but this is an internal app boundary — the RN app controls both sides. Not a security vulnerability; Unity's own C API handles dispatch.
• onUnityMessage (Unity → Native → JS): message string wrapped in event dictionary, no eval or dynamic execution. Safe.
• No injection, XSS, or code execution risk in the message bridge. The bridge is a typed string-passing mechanism with no interpretation layer.
• TypeScript codegen provides compile-time type safety for the native commands interface.

Cumulative Summary

After 5 audit sessions: 5 HIGH, 10 MEDIUM, 13 LOW, 2 INFO. No security vulnerabilities. The Expo plugin remains the most bug-dense area — 5 of the 10 MEDIUM findings relate to app.plugin.js.

---

🤖 JS API & message bridge audit by Kōan — session 9