react-native-inapp-inspector@2.5.20
Screen-aware in-app network inspector, API debugger, and DevTools for React Native & Expo. Standalone on-device alternative to Flipper and Reactotron with page-wise API attribution, cURL export, console symbolication, and storage editing.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package performs undisclosed runtime telemetry by default when its inspector is used, including app/device details and filter values sent to Google Analytics. This warrants a warning, but the behavior is not install-time collection or credential theft, and callers can disable it.
Static reason
No blocking static signals were detected.
Trigger
The application enables and mounts the inspector; telemetry is on by default and can be disabled with the telemetry option.
Impact
App and device details and filter text may be disclosed to the analytics endpoint without explicit opt-in.
Mechanism
The package posts analytics events and metadata to Google Analytics; filter events can include the entered filter value.
AI rationale
The package performs undisclosed runtime telemetry by default when its inspector is used, including app/device details and filter values sent to Google Analytics. This warrants a warning, but the behavior is not install-time collection or credential theft, and callers can disable it.
Evidence
dist/commonjs/index.jsdist/commonjs/helpers/telemetry.js
Network endpoints1
www.google-analytics.com/g/collect
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Mounting the inspector enables telemetry by default unless the caller sets telemetry to false.
- Telemetry is sent to Google Analytics.
- Telemetry includes app and device metadata, including device brand, model, type, locale, and country code.
- Inspector filter events include the filter value in telemetry.
Evidence against
- Telemetry runs when the inspector component is enabled and mounted, rather than during package installation or import.
- The telemetry setting can be disabled by the caller.
- The flagged Metro process execution serves an explicit Gradle build feature.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/esm/metro.jsView file
1import u from"fs";import f from"path";import A from"os";import{spawn as _}from"child_process";let e={status:"idle",scheme:"assembleRelease",clean:!0,progress:0,currentTask:"",logs:...
L2: `);for(const l of m){const g=l.trim();if(g&&(e.logs.push(g),e.logs.length>150&&e.logs.shift()),g.startsWith("> Task :")){d++;const h=g.replace("> Task ",""),b=Math.min(94,Math.roun...
High
1import u from"fs";import f from"path";import A from"os";import{spawn as _}from"child_process";let e={status:"idle",scheme:"assembleRelease",clean:!0,progress:0,currentTask:"",logs:...
L2: `);for(const l of m){const g=l.trim();if(g&&(e.logs.push(g),e.logs.length>150&&e.logs.shift()),g.startsWith("> Task :")){d++;const h=g.replace("> Task ",""),b=Math.min(94,Math.roun...
L3: `);for(const l of m){const g=l.trim();g&&(e.logs.push(g),e.logs.length>150&&e.logs.shift())}(c.includes("FAILURE")||c.includes("error:"))&&(e.error=(e.error||"")+c.slice(0,300))}),...
L4: <!DOCTYPE html>
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/esm/metro.jsView on unpkg · L1Findings
5 High5 Medium6 Low
HighChild Processdist/esm/metro.js
HighShell
HighSame File Env Network Executiondist/esm/metro.js
HighShips High Entropy Blobandroid/build/tmp/compileDebugJavaWithJavac/previous-compilation-data.bin
HighSemantic Analysis Limiteddist/commonjs/components/AnalyticsDetail.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryandroid/build/intermediates/runtime_library_classes_dir/debug/bundleLibRuntimeToDirDebug/com/inappinspector/InAppInspectorFloatingView$iconView$1.class
MediumShips Compressed Blobandroid/build/intermediates/compile_library_classes_jar/debug/bundleLibCompileToJarDebug/classes.jar
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to react-native-inapp-inspector@2.5.20.
See all versions of react-native-inapp-inspector for other recorded verdicts.
- Review the evidence and your use of react-native-inapp-inspector@2.5.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.