@inversifyjs/http-insights@0.3.0
InversifyJs HTTP insights
AI Security Review
scanned 6d ago · by lpm-firewall-aiProvider setup unconditionally resets the package's local insights database, deleting previously collected records. This is a suspicious destructive default, though it is limited to the package's own database and is triggered by an explicit setup call.
Static reason
No blocking static signals were detected.
Trigger
An application calls HttpInsightsProvider.provide(container).
Impact
Previously stored HTTP insights are erased each time setup runs.
Mechanism
The loaded database module calls resetDb, which removes the configured SQLite database and related journal files before creating a fresh database.
AI rationale
Provider setup unconditionally resets the package's local insights database, deleting previously collected records. This is a suspicious destructive default, though it is limited to the package's own database and is triggered by an explicit setup call.
Evidence
lib/insights/adapter/inversify/services/HttpInsightsProvider.jslib/foundation/db/adapter/inversify/modules/DbContainerModule.jslib/generated/prisma-migrate/index.jslib/foundation/db/models/databaseUrl.js./.inversify/insights.db./.inversify/insights.db-journal./.inversify/insights.db-wal./.inversify/insights.db-shm
Decision evidence
public snapshotAI called this Suspicious at 98.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Calling HttpInsightsProvider.provide loads the database module during setup.
- The database module calls resetDb with the package's configured database URL.
- resetDb removes the database and its journal, WAL, and shared-memory files before recreating the database.
- The configured database path is ./.inversify/insights.db.
Evidence against
- The package is described as HTTP insights instrumentation and stores captured request data in a local SQLite database.
- The reset occurs when the application explicitly calls provide; the package entry point only exports the provider.
Behavioral surface
CryptoFilesystem
Minified
Source & flagged code
4 flaggedlib/insights/adapter/inversify/services/HttpInsightsProvider.jsView file
12async provide(container) {
if (this.#provided) {
throw new Error('Cannot provide insights more than once');
}
await container.loadAsync(new DbContainerModule(), new InsightsContainerModule(), new InstrumentationContainerModule());
this.#eventSink = container.get(HttpInsightsEventSi
Medium
Ai Review Evidence
Calling HttpInsightsProvider.provide loads the database module during setup.
lib/insights/adapter/inversify/services/HttpInsightsProvider.jsView on unpkg · L12lib/foundation/db/adapter/inversify/modules/DbContainerModule.jsView file
7export class DbContainerModule extends ContainerModule {
constructor() {
super(async (options) => {
await resetDb(DATABASE_URL);
await this.#buildPrismaContainerModule().load(options);
});
}
#buildPrismaContainerModule() {
return new PrismaContainerModule({
adapter: {
bui
Findings
4 Medium2 Low
MediumAi Review Evidencelib/insights/adapter/inversify/services/HttpInsightsProvider.js
MediumAi Review Evidencelib/foundation/db/adapter/inversify/modules/DbContainerModule.js
MediumAi Review Evidencelib/generated/prisma-migrate/index.js
MediumAi Review Evidencelib/foundation/db/models/databaseUrl.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @inversifyjs/http-insights@0.3.0.
See all versions of @inversifyjs/http-insights for other recorded verdicts.
- Review the evidence and your use of @inversifyjs/http-insights@0.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.