registry / react-native-inapp-inspector / 2.5.11
react-native-inapp-inspector@2.5.11
The zero-config, all-in-one in-app debugger & network logger for React Native & Expo (Flipper / Chucker alternative). Inspect Network (fetch/Axios/GraphQL), Console logs with Metro Symbolication, Redux State, Firebase Analytics, Storage (AsyncStorage/MMKV
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found package-aligned React Native debugging features and no concrete malicious behavior. The remote version check is limited to development mode and the package's npm registry endpoint.
Static reason
No blocking static signals were detected.
Trigger
A consumer imports the package or explicitly invokes its exported developer helpers.
Impact
No unconsented installation mutation, credential collection, or external data exfiltration was established.
Mechanism
The inspected code renders inspection controls and performs a development-only package version check.
AI rationale
Static inspection found package-aligned React Native debugging features and no concrete malicious behavior. The remote version check is limited to development mode and the package's npm registry endpoint.
Network endpoints1
registry.npmjs.org/react-native-inapp-inspector/latest
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes built JavaScript entrypoints and contains no preinstall, install, or postinstall hook.
- The Metro helper starts its server only through an exported function.
- The analytics detail component presents share and copy controls for an event.
- The required Android build artifact contains an ordinary Android library identifier.
- The only inspected remote request is development-gated and checks this package's npm registry version.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
8 flaggeddist/esm/metro.jsView file
1import u from"fs";import f from"path";import A from"os";import{spawn as _}from"child_process";let e={status:"idle",scheme:"assembleRelease",clean:!0,progress:0,currentTask:"",logs:...
L2: `);for(const l of m){const g=l.trim();if(g&&(e.logs.push(g),e.logs.length>150&&e.logs.shift()),g.startsWith("> Task :")){d++;const h=g.replace("> Task ",""),b=Math.min(94,Math.roun...
High
1import u from"fs";import f from"path";import A from"os";import{spawn as _}from"child_process";let e={status:"idle",scheme:"assembleRelease",clean:!0,progress:0,currentTask:"",logs:...
L2: `);for(const l of m){const g=l.trim();if(g&&(e.logs.push(g),e.logs.length>150&&e.logs.shift()),g.startsWith("> Task :")){d++;const h=g.replace("> Task ",""),b=Math.min(94,Math.roun...
L3: `);for(const l of m){const g=l.trim();g&&(e.logs.push(g),e.logs.length>150&&e.logs.shift())}(c.includes("FAILURE")||c.includes("error:"))&&(e.error=(e.error||"")+c.slice(0,300))}),...
L4: <!DOCTYPE html>
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/esm/metro.jsView on unpkg · L1Findings
5 High6 Medium6 Low
HighChild Processdist/esm/metro.js
HighShell
HighSame File Env Network Executiondist/esm/metro.js
HighShips High Entropy Blobandroid/build/tmp/compileDebugJavaWithJavac/previous-compilation-data.bin
HighSemantic Analysis Limiteddist/commonjs/components/AnalyticsDetail.js
MediumDynamic Requirebin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryandroid/build/intermediates/runtime_library_classes_dir/debug/bundleLibRuntimeToDirDebug/com/inappinspector/InAppInspectorFloatingView$iconView$1.class
MediumShips Compressed Blobandroid/build/intermediates/compile_library_classes_jar/debug/bundleLibCompileToJarDebug/classes.jar
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to react-native-inapp-inspector@2.5.11.
See all versions of react-native-inapp-inspector for other recorded verdicts.
- Review the evidence and your use of react-native-inapp-inspector@2.5.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.