react-native-inapp-inspector@2.5.19
The zero-config, all-in-one in-app debugger & network logger for React Native & Expo (Flipper, Reactotron & Chucker alternative). Intercept XHR with onloadend support, early pre-mount request queueing, fetch, Axios & GraphQL, inspect console logs with Met
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe server is an intentional developer utility, but its unauthenticated network interface permits remote build-task triggers and APK access once launched. This is a real conditional exposure, so warn rather than block.
Static reason
No blocking static signals were detected.
Trigger
A user starts the package CLI or its APK-serving script while the server is reachable over a network.
Impact
Remote callers may trigger project build-task behavior, interrupt or consume build resources, and download APKs.
Mechanism
HTTP requests select a Gradle scheme and invoke the build, or request APK files; the server has no authentication check.
AI rationale
The server is an intentional developer utility, but its unauthenticated network interface permits remote build-task triggers and APK access once launched. This is a real conditional exposure, so warn rather than block.
Evidence
bin/cli.jsdist/commonjs/metro.js
Network endpoints5
0.0.0.0:8083/__inapp_inspector/build-apk/__inapp_inspector/stop-build/app-debug.apk/__inapp_inspector/apk
Decision evidence
public snapshotAI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest registers a CLI and an explicit APK-serving script; the CLI starts the standalone server.
- The server listens on 0.0.0.0 and handles build and APK requests without an authentication check.
- The build route accepts a request-supplied Gradle scheme, then starts Gradle in the current project; remote callers can trigger project tasks and retrieve available APKs.
- Both builds attempt to share the exported file through the native helper, then fall back to React Native’s share sheet with the report text and optional file URI.
Evidence against
- The server starts only when a user invokes the package CLI or its APK-serving script, consistent with developer tooling.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/esm/metro.jsView file
1import u from"fs";import f from"path";import A from"os";import{spawn as _}from"child_process";let e={status:"idle",scheme:"assembleRelease",clean:!0,progress:0,currentTask:"",logs:...
L2: `);for(const l of m){const g=l.trim();if(g&&(e.logs.push(g),e.logs.length>150&&e.logs.shift()),g.startsWith("> Task :")){d++;const h=g.replace("> Task ",""),b=Math.min(94,Math.roun...
High
1import u from"fs";import f from"path";import A from"os";import{spawn as _}from"child_process";let e={status:"idle",scheme:"assembleRelease",clean:!0,progress:0,currentTask:"",logs:...
L2: `);for(const l of m){const g=l.trim();if(g&&(e.logs.push(g),e.logs.length>150&&e.logs.shift()),g.startsWith("> Task :")){d++;const h=g.replace("> Task ",""),b=Math.min(94,Math.roun...
L3: `);for(const l of m){const g=l.trim();g&&(e.logs.push(g),e.logs.length>150&&e.logs.shift())}(c.includes("FAILURE")||c.includes("error:"))&&(e.error=(e.error||"")+c.slice(0,300))}),...
L4: <!DOCTYPE html>
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/esm/metro.jsView on unpkg · L1Findings
5 High5 Medium6 Low
HighChild Processdist/esm/metro.js
HighShell
HighSame File Env Network Executiondist/esm/metro.js
HighShips High Entropy Blobandroid/build/tmp/compileDebugJavaWithJavac/previous-compilation-data.bin
HighSemantic Analysis Limiteddist/commonjs/components/AnalyticsDetail.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryandroid/build/intermediates/runtime_library_classes_dir/debug/bundleLibRuntimeToDirDebug/com/inappinspector/InAppInspectorFloatingView$iconView$1.class
MediumShips Compressed Blobandroid/build/intermediates/compile_library_classes_jar/debug/bundleLibCompileToJarDebug/classes.jar
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to react-native-inapp-inspector@2.5.19.
See all versions of react-native-inapp-inspector for other recorded verdicts.
- Review the evidence and your use of react-native-inapp-inspector@2.5.19 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.