react-native-inapp-inspector@2.5.6
The zero-config, all-in-one in-app debugger & network logger for React Native & Expo (Flipper / Chucker alternative). Inspect Network (fetch/Axios/GraphQL), Console logs with Metro Symbolication, Redux State, Firebase Analytics, Storage (AsyncStorage/MMKV
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not an install-hook attack or arbitrary code execution, but it contains automatic, persistent telemetry with obfuscated configuration. The concrete data transmission warrants a warning rather than a publish block.
Static reason
No blocking static signals were detected.
Trigger
Rendering the NetworkInspector wrapper with its default telemetry setting.
Impact
Tracks an app installation and its device characteristics without an explicit opt-in.
Mechanism
Automatic device and app telemetry POST requests.
AI rationale
This is not an install-hook attack or arbitrary code execution, but it contains automatic, persistent telemetry with obfuscated configuration. The concrete data transmission warrants a warning rather than a publish block.
Evidence
dist/commonjs/helpers/telemetry.jsdist/commonjs/index.jsdist/commonjs/constants/telemetryConfig.js
Network endpoints1
www.google-analytics.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The shipped telemetry configuration contains obfuscated analytics credentials.
- The inspector wrapper enables telemetry by default and sends a persistent client identifier plus app, device, locale, and usage metadata to Google Analytics when mounted.
- The telemetry request runs automatically rather than only after an explicit telemetry action.
Evidence against
- The manifest has only a prepare script; there is no install or postinstall hook.
- The observed network target is Google Analytics, and the inspected telemetry code does not send captured network bodies, console logs, storage values, or media.
- The command-line server and Gradle process control are exposed through an explicit user command, not import-time execution.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/esm/metro.jsView file
1import u from"fs";import f from"path";import A from"os";import{spawn as _}from"child_process";let e={status:"idle",scheme:"assembleRelease",clean:!0,progress:0,currentTask:"",logs:...
L2: `);for(const l of m){const g=l.trim();if(g&&(e.logs.push(g),e.logs.length>150&&e.logs.shift()),g.startsWith("> Task :")){d++;const h=g.replace("> Task ",""),b=Math.min(94,Math.roun...
High
1import u from"fs";import f from"path";import A from"os";import{spawn as _}from"child_process";let e={status:"idle",scheme:"assembleRelease",clean:!0,progress:0,currentTask:"",logs:...
L2: `);for(const l of m){const g=l.trim();if(g&&(e.logs.push(g),e.logs.length>150&&e.logs.shift()),g.startsWith("> Task :")){d++;const h=g.replace("> Task ",""),b=Math.min(94,Math.roun...
L3: `);for(const l of m){const g=l.trim();g&&(e.logs.push(g),e.logs.length>150&&e.logs.shift())}(c.includes("FAILURE")||c.includes("error:"))&&(e.error=(e.error||"")+c.slice(0,300))}),...
L4: <!DOCTYPE html>
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/esm/metro.jsView on unpkg · L1Findings
4 High5 Medium6 Low
HighChild Processdist/esm/metro.js
HighSame File Env Network Executiondist/esm/metro.js
HighShips High Entropy Blobandroid/build/tmp/compileDebugJavaWithJavac/previous-compilation-data.bin
HighSemantic Analysis Limiteddist/commonjs/components/AnalyticsDetail.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryandroid/build/intermediates/runtime_library_classes_dir/debug/bundleLibRuntimeToDirDebug/com/inappinspector/InAppInspectorFloatingView$iconView$1.class
MediumShips Compressed Blobandroid/build/intermediates/compile_library_classes_jar/debug/bundleLibCompileToJarDebug/classes.jar
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to react-native-inapp-inspector@2.5.6.
See all versions of react-native-inapp-inspector for other recorded verdicts.
- Review the evidence and your use of react-native-inapp-inspector@2.5.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.