react-native-inapp-inspector@2.5.17
The zero-config, all-in-one in-app debugger & network logger for React Native & Expo (Flipper / Chucker alternative). Inspect Network (fetch/Axios/GraphQL), Console logs with Metro Symbolication, Redux State, Firebase Analytics, Storage (AsyncStorage/MMKV
AI Security Review
scanned 22d ago · by lpm-firewall-aiSource inspection confirmed an unauthenticated network route that triggers caller-selected Gradle argument processing in the consumer project. The server requires explicit CLI startup, so this supports a warning for a dangerous capability rather than a malicious verdict.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A developer explicitly starts the APK server CLI, then a client able to reach its listening port requests the build route.
Impact
A network client can trigger Gradle task or option processing in the developer’s project, with effects determined by its Gradle configuration and available tasks.
Mechanism
The HTTP handler forwards the `scheme` query value to the Gradle subprocess as an argument and binds the server to all network interfaces.
AI rationale
Source inspection confirmed an unauthenticated network route that triggers caller-selected Gradle argument processing in the consumer project. The server requires explicit CLI startup, so this supports a warning for a dangerous capability rather than a malicious verdict.
Evidence
bin/cli.jsdist/commonjs/metro.js
Network endpoints1
0.0.0.0:<port>/__inapp_inspector/build-apk
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package’s APK-serving CLI starts the standalone server when explicitly invoked.
- The build route accepts a `scheme` query value and passes it to the Gradle build helper.
- The helper passes the selected Gradle argument to a subprocess running in the consumer project directory.
- The server binds to all network interfaces, and the reviewed build route has no authentication check.
- The flagged Metro locations resolve to APK paths, build status, and APK serving rather than account actions.
Evidence against
- The network service requires an explicit CLI invocation to start.
- The Gradle process uses an argument array rather than a shell command.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
8 flaggeddist/esm/metro.jsView file
1import u from"fs";import f from"path";import A from"os";import{spawn as _}from"child_process";let e={status:"idle",scheme:"assembleRelease",clean:!0,progress:0,currentTask:"",logs:...
L2: `);for(const l of m){const g=l.trim();if(g&&(e.logs.push(g),e.logs.length>150&&e.logs.shift()),g.startsWith("> Task :")){d++;const h=g.replace("> Task ",""),b=Math.min(94,Math.roun...
High
1import u from"fs";import f from"path";import A from"os";import{spawn as _}from"child_process";let e={status:"idle",scheme:"assembleRelease",clean:!0,progress:0,currentTask:"",logs:...
L2: `);for(const l of m){const g=l.trim();if(g&&(e.logs.push(g),e.logs.length>150&&e.logs.shift()),g.startsWith("> Task :")){d++;const h=g.replace("> Task ",""),b=Math.min(94,Math.roun...
L3: `);for(const l of m){const g=l.trim();g&&(e.logs.push(g),e.logs.length>150&&e.logs.shift())}(c.includes("FAILURE")||c.includes("error:"))&&(e.error=(e.error||"")+c.slice(0,300))}),...
L4: <!DOCTYPE html>
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/esm/metro.jsView on unpkg · L1Findings
6 High5 Medium6 Low
HighChild Processdist/esm/metro.js
HighShell
HighSame File Env Network Executiondist/esm/metro.js
HighShips High Entropy Blobandroid/build/tmp/compileDebugJavaWithJavac/previous-compilation-data.bin
HighSemantic Analysis Limiteddist/commonjs/components/AnalyticsDetail.js
HighPrevious Version Dangerous Deltadist/esm/helpers/searchQueryParser.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryandroid/build/intermediates/runtime_library_classes_dir/debug/bundleLibRuntimeToDirDebug/com/inappinspector/InAppInspectorFloatingView$iconView$1.class
MediumShips Compressed Blobandroid/build/intermediates/compile_library_classes_jar/debug/bundleLibCompileToJarDebug/classes.jar
Affected versions and remediation
This report applies to react-native-inapp-inspector@2.5.17.
See all versions of react-native-inapp-inspector for other recorded verdicts.
- Review the evidence and your use of react-native-inapp-inspector@2.5.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.