react-native-inapp-inspector@2.5.18
The zero-config, all-in-one in-app debugger & network logger for React Native & Expo (Flipper, Reactotron & Chucker alternative). Intercept XHR with onloadend support, early pre-mount request queueing, fetch, Axios & GraphQL, inspect console logs with Met
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe package exposes a user-started server that accepts unauthenticated network requests and forwards an unvalidated value to Gradle, creating a concrete remote execution risk. The feature is tied to the APK development workflow, so the source supports a vulnerability warning rather than a malware finding.
Static reason
No blocking static signals were detected.
Trigger
A user starts the package CLI, then a reachable client requests the build endpoint.
Impact
A remote client may cause Gradle-controlled project code to run and may download the generated APK.
Mechanism
The endpoint reads the supplied scheme query parameter and passes it to the project’s Gradle wrapper without validation.
AI rationale
The package exposes a user-started server that accepts unauthenticated network requests and forwards an unvalidated value to Gradle, creating a concrete remote execution risk. The feature is tied to the APK development workflow, so the source supports a vulnerability warning rather than a malware finding.
Evidence
package.jsonbin/cli.jsdist/commonjs/metro.js
Network endpoints2
0.0.0.0:8083/__inapp_inspector/build-apk
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- package.json maps the CLI to bin/cli.js; its prepare hook only runs the package build.
- The CLI starts the standalone server when a user invokes it, using port 8083 by default.
- The build endpoint accepts a query parameter as the Gradle task argument; the wrapper runs it without validation, and the server listens on all interfaces.
- The flagged account-action locations in metro.js are APK path searches, build status handling, and APK download code, not authenticated account actions.
- The export helper writes report content to a native file and invokes native file sharing, falling back to React Native Share.share if native sharing does not succeed.
Evidence against
- The server starts only when the user invokes the CLI, and the behavior supports the package’s APK development workflow.
- The source establishes an unauthenticated network execution risk, but does not establish that this feature is intended as an attack.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
Source & flagged code
7 flaggeddist/esm/metro.jsView file
1import u from"fs";import f from"path";import A from"os";import{spawn as _}from"child_process";let e={status:"idle",scheme:"assembleRelease",clean:!0,progress:0,currentTask:"",logs:...
L2: `);for(const l of m){const g=l.trim();if(g&&(e.logs.push(g),e.logs.length>150&&e.logs.shift()),g.startsWith("> Task :")){d++;const h=g.replace("> Task ",""),b=Math.min(94,Math.roun...
High
1import u from"fs";import f from"path";import A from"os";import{spawn as _}from"child_process";let e={status:"idle",scheme:"assembleRelease",clean:!0,progress:0,currentTask:"",logs:...
L2: `);for(const l of m){const g=l.trim();if(g&&(e.logs.push(g),e.logs.length>150&&e.logs.shift()),g.startsWith("> Task :")){d++;const h=g.replace("> Task ",""),b=Math.min(94,Math.roun...
L3: `);for(const l of m){const g=l.trim();g&&(e.logs.push(g),e.logs.length>150&&e.logs.shift())}(c.includes("FAILURE")||c.includes("error:"))&&(e.error=(e.error||"")+c.slice(0,300))}),...
L4: <!DOCTYPE html>
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/esm/metro.jsView on unpkg · L1Findings
5 High5 Medium6 Low
HighChild Processdist/esm/metro.js
HighShell
HighSame File Env Network Executiondist/esm/metro.js
HighShips High Entropy Blobandroid/build/tmp/compileDebugJavaWithJavac/previous-compilation-data.bin
HighSemantic Analysis Limiteddist/commonjs/components/AnalyticsDetail.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryandroid/build/intermediates/runtime_library_classes_dir/debug/bundleLibRuntimeToDirDebug/com/inappinspector/InAppInspectorFloatingView$iconView$1.class
MediumShips Compressed Blobandroid/build/intermediates/compile_library_classes_jar/debug/bundleLibCompileToJarDebug/classes.jar
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to react-native-inapp-inspector@2.5.18.
See all versions of react-native-inapp-inspector for other recorded verdicts.
- Review the evidence and your use of react-native-inapp-inspector@2.5.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.