[Android] App is rejected due to a policy violation by Google Play ( Violation of Malicious Behavior policy )?

[arlovip]

My App is rejected by Google play team

Steps to Reproduce

1. Install CodePush as usually
2. Release on Google Play to approve
3. Rejected by Google Play with an email ( Issue: Violation of Malicious Behavior policy )

Expected Behavior

Release to Google Play Store successfully.

Actual Behavior

App is rejected by Google Play Team.

Email contents:

Hi Developers at `MY COMPANY`,

Thanks for submitting `APP-NAME (`APP-ID`) to Google Play. After review, your app has been rejected 
due to a policy violation. If you submitted an update, the previous version of your app is still 
available on Google Play.

Issue: Violation of Malicious Behavior policy

An app distributed via Google Play may not modify, replace, or update itself using any method other than 
Google Play's update mechanism. Likewise, an app may not download executable code (e.g. dex, JAR, .so files) 
from a source other than Google Play.

Next steps: Submit your updated app for another review

Read through the Malicious Behavior policy for more details and examples of policy violations.
If possible, make changes to bring your app into compliance.
Make sure that your app is compliant with all other Developer Program Policies. Additional enforcement could 
occur if there are further policy violations.
Sign in to your Play Console and submit the policy compliant update.
You may also be interested in exploring Dynamic Delivery as an alternative implementation.

If you’ve reviewed the policy and feel this rejection may have been in error, please reach out to our policy support team. We'll get back to you within 2 business days.

Please help us improve the developer experience by completing this two question survey. Thanks for your continued support of Google Play.

Best,

The Google Play Team

Reproducible Demo

class App extends Component {

      componentDidMount() {
        CodePush.sync({
            updateDialog: false,
            installMode: CodePush.InstallMode.ON_NEXT_RESTART,
            deploymentKey: 'my deployment key here',
        }, status => {
            __DEV__ && console.warn(`CodePush -> status: ${status}`);
        }, ({receivedBytes, totalBytes}) => {
            __DEV__ && console.warn(`CodePush -> totalBytes: ${totalBytes}, receivedBytes: ${receivedBytes}`);
        });
      }

      render() {
             return <View>
                    ...other code snippets
             </View>;
      }
}

export default CodePush(App);

Environment

info Fetching system and libraries information...
System:
    OS: macOS 10.15.4
    CPU: (4) x64 Intel(R) Core(TM) i3-8100B CPU @ 3.60GHz
    Memory: 746.19 MB / 8.00 GB
    Shell: 5.7.1 - /bin/zsh
  Binaries:
    Node: 12.10.0 - /usr/local/bin/node
    Yarn: 1.17.3 - ~/.yarn/bin/yarn
    npm: 6.11.3 - /usr/local/bin/npm
    Watchman: 4.9.0 - /usr/local/bin/watchman
  Managers:
    CocoaPods: 1.8.4 - /usr/local/bin/pod
  SDKs:
    iOS SDK:
      Platforms: iOS 13.2, DriverKit 19.0, macOS 10.15, tvOS 13.2, watchOS 6.1
    Android SDK:
      API Levels: 23, 26, 27, 28, 29
      Build Tools: 26.0.1, 27.0.3, 28.0.2, 28.0.3, 29.0.2, 29.0.3
      System Images: android-23 | Intel x86 Atom_64, android-23 | Google APIs Intel x86 Atom, android-23 | Google APIs Intel x86 Atom_64, android-26 | Google APIs Intel x86 Atom, android-27 | Intel x86 Atom_64, android-27 | Google APIs Intel x86 Atom, android-27 | Google Play Intel x86 Atom, android-28 | Google Play Intel x86 Atom
      Android NDK: Not Found
  IDEs:
    Android Studio: 3.5 AI-191.8026.42.35.5977832
    Xcode: 11.3.1/11C505 - /usr/bin/xcodebuild
  Languages:
    Java: 1.8.0_181 - /Library/Java/JavaVirtualMachines/jdk1.8.0_181.jdk/Contents/Home/bin/javac
    Python: 2.7.16 - /usr/bin/python
  npmPackages:
    @react-native-community/cli: Not Found
    react: 16.13.1 => 16.13.1
    react-native: 0.63.2 => 0.63.2
  npmGlobalPackages:
    *react-native*: Not Found

NOTE: This app has been approved for the App Store ( iOS ) successfully but rejected by Google Play only. Is it possible to use CodePush to release App on Google Play Store? Or any other help for this? Any solutions are appreciated.

[alexandergoncharov-zz]

Hi @lchenfox,
Thanks for reporting!

We investigated google docs and found that updating with javascript code is allowed.
Please check this docs: https://support.google.com/googleplay/android-developer/answer/9888379?hl=en
Also, I'll update our Readme with it.

[alexandergoncharov-zz]

I opened #1946 for updating Store guidelines docs section.

[arlovip]

@alexandergoncharov Thank u for reply and explanation. Indeed, it was approved to Play Store last night after modifying another third-party repo about push notification used in my project, which may download executable code. So, it's rejected not because of using CodePush. I got it wrong. Anyway, thank u and this great repo again. And hope this issue can help others who may have the same problem later. Closing this issue.