Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@mattermost/react-native-emm
Advanced tools
A React Native Module for EMM managed configurations
Using npm:
npm install --save-exact @mattermost/react-native-emm
or using yarn:
yarn add -E @mattermost/react-native-emm
Then follow the instructions for your platform to link @mattermost/react-native-emm into your project:
React Native 0.60 and above
Run npx pod-install
. Linking is not required in React Native 0.60 and above.
React Native 0.59 and below
Run react-native link @mattermost/react-native-emm
to link the react-native-emm library.
Setup your Podfile like it is described in the react-native documentation.
pod 'Folly', :podspec => '../node_modules/react-native/third-party-podspecs/Folly.podspec'
+ `pod 'react-native-emm', :path => '../node_modules/@mattermost/react-native-emm/react-native-emm.podspec'`
end
React Native 0.60 and above Linking is not required in React Native 0.60 and above.
React Native 0.59 and below
Run react-native link @mattermost/react-native-emm
to link the react-native-emm library.
Or if you have trouble, make the following additions to the given files manually:
include ':mattermost.Emm'
project(':mattermost.Emm').projectDir = new File(rootProject.projectDir, '../node_modules/@mattermost/react-native-emm/android')
dependencies {
...
+ implementation project(':mattermost.Emm')
}
android.useAndroidX=true
On top, where imports are:
import com.mattermost.Emm.EmmPackage;
Add the EmmPackage
class to your list of exported packages.
@Override
protected List<ReactPackage> getPackages() {
@SuppressWarnings("UnnecessaryLocalVariable")
List<ReactPackage> packages = new PackageList(this).getPackages();
// Packages that cannot be autolinked yet can be added manually here, for ReactNativeEmmExample:
// packages.add(new MyReactNativePackage());
+ packages.add(new EmmPackage());
return packages;
}
Configure your Android app to handle managed configurations
Perform this steps manually as they are not handled by Autolinking
.
Enable APP_RESTRICTIONS
in your Android manifest file
<application
android:name=".MainApplication"
android:label="@string/app_name"
android:icon="@mipmap/ic_launcher"
android:roundIcon="@mipmap/ic_launcher_round"
android:allowBackup="false"
android:theme="@style/AppTheme">
+ <meta-data android:name="android.content.APP_RESTRICTIONS" android:resource="@xml/app_restrictions" />
<activity
android:name=".MainActivity"
...
</application>
In this file you'll need to add all available managed configuration for the app (see example). For more information check out Android's guide: Set up managed configurations
<?xml version="1.0" encoding="utf-8"?>
<restrictions xmlns:android="http://schemas.android.com/apk/res/android">
<restriction
android:key="YouManagedConfigKey"
android:title="A title for your key"
android:description="A description of what this key does"
android:restrictionType="string"
android:defaultValue="false" />
</restrictions>
Note: In a production app, android:title
and android:description
should be drawn from a localized resource file.
// Load the module
import Emm from '@mattermost/react-native-emm';
addListener(callback: ManagedConfigCallBack): EmitterSubscription;
Event used to listen for Managed Configuration changes while the app is running.
Example:
useEffect(() => {
const listener = Emm.addListener((config: AuthenticateConfig) => {
setManaged(config);
});
return () => {
listener.remove();
};
});
Note: Don't forget to remove the listener when no longer needed to avoid memory leaks.
authenticate(opts: AuthenticateConfig): Promise<boolean>
Request the user to authenticate using one of the device built-in authentication methods. You should call this after verifying that the device is secure
Example:
const opts: AuthenticateConfig = {
reason: 'Some Reason',
description: 'Some Description',
fallback: true,
supressEnterPassword: true,
};
const authenticated = await Emm.authenticate(opts);
Platforms: All
deviceSecureWith(): Promise<AuthenticationMethods>
Get available device authentication methods.
Example:
const optionsAvailable: AuthenticationMethods = await Emm.deviceSecureWith()
Platforms: All
enableBlurScreen(enabled: boolean): void
iOS: Blurs the application screen in the App Switcher view Android: Blanks the application screen in the Task Manager
Example:
Emm.enableBlurScreen(true);
Platforms: All
exitApp(): void
Forces the app to exit.
Example:
Emm.exitApp();
Platforms: All
getManagedConfig(): Promise<Record<string, any>>
Retrieves the Managed Configuration set by the Enterprise Mobility Management provider.
Notes:
Android uses the Restriction Manager to set the managed configuration settings and values while iOS uses NSUserDefaults under the key com.apple.configuration.managed
Example:
const manged: Record<string, any> = Emm.getManagedConfig(); // Managed configuration object containing keys and values
Platforms: all
isDeviceSecured(): Promise<boolean>
Determines if the device has at least one authentication method enabled.
Example:
const secured = await Emm.isDeviceSecured();
Platforms: All
openSecuritySettings(): void
If the device is not secured, you can use this function to take the user to the Device Security Settings to set up an authentication method.
Example:
Emm.openSecuritySettings();
Note: This function will close the running application.
Platforms: Android
setAppGroupId(identifier: string): void
At times you may built an iOS extension application (ex: Share Extension / Notification Extension), if you need access to the Managed Configuration you should set this value to your App Group Identifier. This will create a copy of the managed configuration found in NSUserDefaults under the key com.apple.configuration.managed
to a shared NSUserDefaults with your App Group identifier
under the same key.
Example:
Emm.setAppGroupId('group.com.example.myapp);
Platforms: iOS
MIT Licensed
FAQs
React Native package for EMM managed configurations
We found that @mattermost/react-native-emm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 11 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.