react-native-inapp-inspector@2.5.14
The zero-config, all-in-one in-app debugger & network logger for React Native & Expo (Flipper / Chucker alternative). Inspect Network (fetch/Axios/GraphQL), Console logs with Metro Symbolication, Redux State, Firebase Analytics, Storage (AsyncStorage/MMKV
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe source implements metadata forwarding to an external analytics service through obfuscated configuration. This supports a warning for data exposure, not a malware block.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Invocation of the telemetry heartbeat while telemetry remains enabled.
Impact
Application and device metadata may leave the device without a visible destination-control mechanism in the inspected code.
Mechanism
The routine generates or reuses a device identifier, assembles metadata, and posts telemetry events to a fixed external collection endpoint.
AI rationale
The source implements metadata forwarding to an external analytics service through obfuscated configuration. This supports a warning for data exposure, not a malware block.
Evidence
dist/commonjs/helpers/telemetry.js
Network endpoints1
www.google-analytics.com/mp/collect
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Telemetry derives a Google Analytics collection endpoint from obfuscated embedded values.
- The telemetry routine creates a persistent device identifier and sends first-open, install, session, and heartbeat events.
- Collected metadata includes application identity, locale, time zone, device model, screen details, and runtime configuration.
Evidence against
- The observed destination is a fixed Google Analytics host rather than an operator-configurable endpoint.
- No credential harvesting or foreign install-time mutation was found in the inspected telemetry path.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
8 flaggeddist/esm/metro.jsView file
1import u from"fs";import f from"path";import A from"os";import{spawn as _}from"child_process";let e={status:"idle",scheme:"assembleRelease",clean:!0,progress:0,currentTask:"",logs:...
L2: `);for(const l of m){const g=l.trim();if(g&&(e.logs.push(g),e.logs.length>150&&e.logs.shift()),g.startsWith("> Task :")){d++;const h=g.replace("> Task ",""),b=Math.min(94,Math.roun...
High
1import u from"fs";import f from"path";import A from"os";import{spawn as _}from"child_process";let e={status:"idle",scheme:"assembleRelease",clean:!0,progress:0,currentTask:"",logs:...
L2: `);for(const l of m){const g=l.trim();if(g&&(e.logs.push(g),e.logs.length>150&&e.logs.shift()),g.startsWith("> Task :")){d++;const h=g.replace("> Task ",""),b=Math.min(94,Math.roun...
L3: `);for(const l of m){const g=l.trim();g&&(e.logs.push(g),e.logs.length>150&&e.logs.shift())}(c.includes("FAILURE")||c.includes("error:"))&&(e.error=(e.error||"")+c.slice(0,300))}),...
L4: <!DOCTYPE html>
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/esm/metro.jsView on unpkg · L1Findings
6 High5 Medium6 Low
HighChild Processdist/esm/metro.js
HighShell
HighSame File Env Network Executiondist/esm/metro.js
HighShips High Entropy Blobandroid/build/tmp/compileDebugJavaWithJavac/previous-compilation-data.bin
HighSemantic Analysis Limiteddist/commonjs/components/AnalyticsDetail.js
HighPrevious Version Dangerous Deltadist/commonjs/helpers/searchQueryParser.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryandroid/build/intermediates/runtime_library_classes_dir/debug/bundleLibRuntimeToDirDebug/com/inappinspector/InAppInspectorFloatingView$iconView$1.class
MediumShips Compressed Blobandroid/build/intermediates/compile_library_classes_jar/debug/bundleLibCompileToJarDebug/classes.jar
Affected versions and remediation
This report applies to react-native-inapp-inspector@2.5.14.
See all versions of react-native-inapp-inspector for other recorded verdicts.
- Review the evidence and your use of react-native-inapp-inspector@2.5.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.