Search the project for compiled libraries by file type, list each with its vendor and version, and ask the vendor what is inside. Native plug-ins are unmanaged code, so a scan focused on C# packages will not describe them, and you must track them yourself.
What a native plug-in is
Unity's manual defines native plug-ins as libraries of unmanaged code written in languages such as C, C++ and Objective-C. They let the C# code you write call functions from those libraries. Unity says you can use both precompiled libraries and source code files as plug-ins, and that with source code Unity compiles and links the plug-in code statically. The feature exists to integrate middleware libraries and reuse existing C and C++ code.
Unity also documents native APIs that let a plug-in interact with engine systems such as rendering, profiling and logging, and says it discovers and loads plug-ins using that API automatically.
Why they hide from scanners
A package manifest lists name and version. A precompiled library is a binary file with, at best, a version string inside. It might bundle open source code you have never heard of, such as image decoders or compression code. Unity's own documentation page does not discuss this, and it need not. It is a feature of how middleware ships.
Steps to build the list
- Search Assets and Packages for dynamic library extensions for each platform you ship: dll, so, dylib, a, and the iOS and Android equivalents. Include framework bundles and archives for mobile.
- Search C# files for DllImport. Unity's manual says the DllImport attribute tells the scripting runtime where to find an unmanaged function, so each match names a library your code calls.
- For each library, record file name, platform, vendor, version, license and where it came from.
- Compare the list with what appears in a build output. Libraries only in a platform folder may only ship on that platform.
- Ask each vendor for a component list or SBOM, and for the date of their most recent security update. If no answer arrives, record the gap.
- Decide the owner who will check vendor release notes.
For SDK vendor questions, see third party SDKs in games and creator apps.
What to do when a library has a known flaw
You usually cannot patch a binary yourself. Options are an updated library from the vendor, replacing the middleware, or isolating the feature. Each takes a release, which is why a good inventory matters before the advisory arrives. The post on engine advisories and rebuilds shows the same logic.
Try it yourself
Click through it at your own pace, or open it full screen.
Click a component and see which fields a useful record carries. Mirror them for each native library.
Quick check
Does Unity compile native plug-ins?
Only when you supply source code, which Unity compiles and links statically. Precompiled libraries are used as they are.
How do I find which libraries my C# calls?
Search for the DllImport attribute. Unity's manual says it tells the scripting runtime where to find an unmanaged function.
Sources
Last reviewed: 19 October 2026.
