@inversifyjs/http-insights@0.2.0
InversifyJs HTTP insights
AI Security Review
scanned 12d ago · by lpm-firewall-aiProvider initialization unconditionally deletes the package’s local insights database, creating a concrete risk of losing stored call records. The behavior supports a warning, but the inspected deletion is scoped to package data and does not establish a broader attack.
Static reason
No blocking static signals were detected.
Trigger
Application code calls HttpInsightsProvider.provide().
Impact
Previously persisted insights data can be lost when the provider is initialized.
Mechanism
The provider loads a database module that unconditionally removes the configured database and its SQLite sidecar files, then recreates the database.
AI rationale
Provider initialization unconditionally deletes the package’s local insights database, creating a concrete risk of losing stored call records. The behavior supports a warning, but the inspected deletion is scoped to package data and does not establish a broader attack.
Evidence
lib/insights/adapter/inversify/services/HttpInsightsProvider.jslib/foundation/db/adapter/inversify/modules/DbContainerModule.jslib/foundation/db/models/databaseUrl.jslib/generated/prisma-migrate/index.js.inversify/insights.db
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Calling the provider’s provide method loads the database module.
- The database module calls resetDb with the package’s configured database URL.
- The configured database is a local insights database at .inversify/insights.db.
- resetDb removes the database and its SQLite sidecar files before recreating it.
Evidence against
- The destructive operation targets this package’s local insights database; no broader file deletion or network transfer was identified.
Behavioral surface
CryptoFilesystem
Minified
Source & flagged code
4 flaggedlib/insights/adapter/inversify/services/HttpInsightsProvider.jsView file
12iner) {
if (this.#provided) {
throw new Error('Cannot provide insights more than once');
}
await container.loadAsync(new DbContainerModule(), new InsightsContainerModule(), new InstrumentationContainerModule());
this.#eventSink = container.get(HttpInsightsEventSink);
this.#provided = true;
}
getEventSink() {
if (this.#eventSink === undefined) {
thr
Medium
Ai Review Evidence
Calling the provider’s provide method loads the database module.
lib/insights/adapter/inversify/services/HttpInsightsProvider.jsView on unpkg · L12lib/foundation/db/adapter/inversify/modules/DbContainerModule.jsView file
6rt { DATABASE_URL } from '../../../models/databaseUrl.js';
export class DbContainerModule extends ContainerModule {
constructor() {
super(async (options) => {
await resetDb(DATABASE_URL);
await this.#buildPrismaContainerModule().load(options);
});
}
#buildPrismaContainerModule() {
return new PrismaContainerModule({
Findings
4 Medium2 Low
MediumAi Review Evidencelib/insights/adapter/inversify/services/HttpInsightsProvider.js
MediumAi Review Evidencelib/foundation/db/adapter/inversify/modules/DbContainerModule.js
MediumAi Review Evidencelib/foundation/db/models/databaseUrl.js
MediumAi Review Evidencelib/generated/prisma-migrate/index.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @inversifyjs/http-insights@0.2.0.
See all versions of @inversifyjs/http-insights for other recorded verdicts.
- Review the evidence and your use of @inversifyjs/http-insights@0.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.