@inversifyjs/http-insights@0.4.0
InversifyJs HTTP insights
AI Security Review
scanned 6d ago · by lpm-firewall-aiNormal provider initialization unconditionally deletes and recreates the package’s insights database, destroying previously collected data without an explicit reset request. This is destructive behavior triggered by the package’s ordinary setup path.
Static reason
No blocking static signals were detected.
Trigger
The application calls `HttpInsightsProvider.provide()`.
Impact
Previously collected HTTP insights are lost on each provider initialization.
Mechanism
Loading `DbContainerModule` invokes `resetDb`, which removes the database file and SQLite sidecars before creating a fresh database.
Attack narrative
When an application provides the insights service, the database module automatically calls `resetDb` on `./.inversify/insights.db`. That function removes the database and its SQLite sidecars, then recreates the database. This silently discards previously collected insights during normal provider initialization.
AI rationale
Normal provider initialization unconditionally deletes and recreates the package’s insights database, destroying previously collected data without an explicit reset request. This is destructive behavior triggered by the package’s ordinary setup path.
Evidence
lib/insights/adapter/inversify/services/HttpInsightsProvider.jslib/foundation/db/adapter/inversify/modules/DbContainerModule.jslib/foundation/db/models/databaseUrl.jslib/generated/prisma-migrate/index.js./.inversify/insights.db./.inversify/insights.db-journal./.inversify/insights.db-wal./.inversify/insights.db-shm
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- Calling `HttpInsightsProvider.provide()` loads the database container module.
- That module calls `resetDb(DATABASE_URL)` whenever it loads.
- The database URL points to `file:./.inversify/insights.db`.
- `resetDb` removes the database and its journal, WAL, and shared-memory files before recreating the database.
Evidence against
- The reset is limited to this package’s local insights database.
- The manifest declares no install lifecycle scripts.
Behavioral surface
CryptoFilesystem
Minified
Source & flagged code
5 flaggedlib/insights/adapter/node/calculations/readSourceMapLocation.jsView file
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
lib/insights/adapter/node/calculations/readSourceMapLocation.jsView on unpkglib/insights/adapter/inversify/services/HttpInsightsProvider.jsView file
12async provide(container) {
if (this.#provided) {
throw new Error('Cannot provide insights more than once');
}
await container.loadAsync(new DbContainerModule(), new InsightsContainerModule(), new InstrumentationContainerModule());
this.#eventSink = container.get
High
Ai Review Evidence
Calling `HttpInsightsProvider.provide()` loads the database container module.
lib/insights/adapter/inversify/services/HttpInsightsProvider.jsFindings
5 High2 Low
HighSemantic Analysis Limitedlib/insights/adapter/node/calculations/readSourceMapLocation.js
HighAi Review Evidencelib/insights/adapter/inversify/services/HttpInsightsProvider.js
HighAi Review Evidencelib/foundation/db/adapter/inversify/modules/DbContainerModule.js
HighAi Review Evidencelib/foundation/db/models/databaseUrl.js
HighAi Review Evidencelib/generated/prisma-migrate/index.js
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @inversifyjs/http-insights@0.4.0.
See all versions of @inversifyjs/http-insights for other recorded verdicts.
- Avoid installing @inversifyjs/http-insights@0.4.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.