v0.8.0 — native-library-informed integrity signals

v0.8.0 - native-library-informed integrity signals

This backward-compatible feature release adds raw Magisk-hide, Frida, emulator, and iOS
reverse-engineering observations to os_integrity (and one to device_security_posture), sourced
from native open-source security libraries and reimplemented in pure Kotlin / Objective-C. The SDK
continues to return raw evidence only: no score, no verdict, no network calls, no persistent id.

Highlights

Magisk-hide-resistant tells (Android)

• magiskAbstractSocketFound — /proc/net/unix contains an abstract socket (name starting with
  @) that is 32+ chars and free of /, ., or spaces, matching Magisk's randomized control socket.
• magicMountModulesFound — a file mapped from /system, /vendor, /product, or /system_ext
  shares the device number of the /data mount, i.e. a Magisk "magic mount" bind-mount. This is
  observable from the app process even when the module path/name is hidden.

Broader Frida evidence (Android)

• fridaThreadNamesFound — Frida worker threads (gum-js-loop, pool-frida, frida-gum) seen in
  /proc/self/task/*/comm.
• fridaInjectorPipeFound — a /proc/self/fd entry whose target contains Frida's linjector pipe.
• fridaListenerPortFound — a LISTEN socket on 27042/27043 in /proc/net/tcp(6), catching
  frida-server before any client connects.
• fridaHandshakeReject (on os_integrity_frida_scan) — the D-Bus/Frida AUTH handshake on port
  27042 answers REJECT, confirming genuine frida-server rather than any other service on that port.

Wider emulator coverage (Android)

More Andy/Nox/VirtualBox/x86 artifact files, a BlueStacks shared-folder path, and /proc/tty/drivers
folded into the goldfish CPU-token scan; more Magisk artifact paths.

iOS reverse-engineering and posture

• parentPidUnexpected — getppid() != 1 (not launchd), a debugger/debugserver-spawned tell.
• jailbreakBypassDetected — the "Shadow" anti-anti-jailbreak tweak is loaded (ShadowRuleset).
• mainExecutableEncrypted — the main Mach-O's LC_ENCRYPTION_INFO cryptid; false on a device
  binary indicates it was decrypted/cracked (repackaging/piracy tell).
• openReverseEngineeringPorts — open loopback ports among 27042 (Frida), 4444 (Needle), 22
  (OpenSSH), 44 (checkra1n).
• lockdownModeEnabled (on device_security_posture, iOS 16+) — Lockdown Mode state.

Backend contract guidance

• Every new field is optional and attacker-influenced; preserve missing versus false.
• The new Android fields are Android-only; the new iOS fields are iOS-only.
• mainExecutableEncrypted is false for development/simulator builds by design — interpret it only
  for production distributions.
• No existing field is removed or renamed.

Verification

• Root Jest suite passed; TypeScript, TurboModule contract, package, and GitHub Pages verification
  passed.
• Pure-Kotlin unit tests cover the new Magisk-socket, Frida-listener, magic-mount device cross-check,
  and Frida-thread-name parsers.

The implementation adds no npm runtime, Gradle runtime, CocoaPods, or bundled binary dependencies;
no JNI/NDK, network requests, persistent identifiers, QUERY_ALL_PACKAGES, runtime permission
prompts, or Apple Required-Reason API declarations were added.

Deferred

An isolated-process re-check (the strongest Magisk DenyList/Shamiko bypass) and the pointer-heavy iOS
hook/breakpoint/Mach-O-hash checks are intentionally not in this release; they require dedicated
design and on-device verification.

Upgrade

npm install react-native-device-risk-signals@0.8.0

For iOS applications, refresh CocoaPods after updating:

cd ios && bundle exec pod install

No existing field is removed or renamed; existing integrations retain their previous behavior.