registry / database-devtools / 0.1.4

database-devtools@0.1.4

Inspect SQLite in React Native & Expo from your browser — browse tables, run SQL, edit data. DevTools for mobile databases.

AI Security Review

scanned 17h ago · by lpm-firewall-ai

The explicitly launched development hub is LAN-accessible and unauthenticated. A network peer can enumerate connected devices, retrieve snapshots, or impersonate a browser client to request database writes.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `npx database-devtools` or the package CLI.

Impact

Network attackers on a reachable interface may read exported SQLite data and request mutations on connected development devices.

Mechanism

Unauthenticated HTTP/WebSocket devtools hub bound to all interfaces.

Rationale

No install-time or covert malicious behavior was found, but the source establishes an unauthenticated LAN-facing database inspection and write control surface. This is a concrete development-tool security vulnerability rather than evidence of malicious intent.

Evidence

package.jsondist/cli.cjsdist/chunk-TNDOAHT5.jsREADME.md.devtools/devtools.json.devtools/manifest.json.devtools/databases/devices/<storageKey>/database.db

Network endpoints4

0.0.0.0:3847ws://0.0.0.0:3847/ws/health/api/devices/:deviceId/snapshot

database-devtools@0.1.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code