registry / reactoradar / 1.6.13

reactoradar@1.6.13

macOS debugger for React Native — Console, Sources, Network, Performance, Memory, Redux, AsyncStorage, React tree. Supports RN 0.74+ with Hermes and New Architecture.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 325 KB of source, external domains: api.github.com, github.com, razorpay.me, registry.npmjs.org, www.linkedin.com

Source & flagged code

4 flagged

bin/cli.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2'use strict';

4const path = require('path');

5const { execSync, spawn } = require('child_process');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L4

7const C = {

8 reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',

9 green: '\x1b[32m', cyan: '\x1b[36m', yellow: '\x1b[33m', magenta: '\x1b[35m',

10};

12const args = process.argv.slice(2);

13const command = args[0] || 'start';

14const appDir = path.resolve(__dirname, '..');

16function printHelp() {

17 console.log();

18 console.log(C.bold + C.magenta + ' ReactoRadar' + C.reset + ' — React Native debugging tool');

19 console.log();

20 console.log(' Usage:');

21 console.log(` ${C.cyan}npx rn-debugger${C.reset} Launch the debugger app`);

22 console.log(` ${C.cyan}npx rn-debugger setup${C.reset} Install SDK into current RN project`);

23 console.log(` ${C.cyan}npx rn-debugger remove${C.reset} Remove SDK from current RN project`);

24 console.log(` ${C.cyan}npx rn-debugger help${C.reset} Show this help`);

preload.jsView file

Lines 1-22javascript

1'use strict';

3const { contextBridge, ipcRenderer } = require('electron');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

preload.jsView on unpkg · L2

5const registeredChannels = new Set();

main.jsView file

Lines 451-491javascript

451

452// ─── IPC from Renderer ────────────────────────────────────────────────────────

453function setupIPC() {

454 ipcMain.on('open-cdp-target', (_, wsUrl) => {

455 // Always fetch fresh targets, then open

456 fetchCDPTargets((targets) => {

457 if

bin/open-debugger.shView file

•path = bin/open-debugger.sh kind = build_helper sizeBytes = 373 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/open-debugger.shView on unpkg

Source & flagged code

4 flagged · loading source

bin/cli.jsView file

4const path = require('path'); L5: const { execSync, spawn } = require('child_process'); L6:

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L4

preload.jsView file

2L3: const { contextBridge, ipcRenderer } = require('electron'); L4:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

preload.jsView on unpkg · L2

main.jsView file

471if (!reactDTServer) startReactDevToolsServer(); L472: // Launch standalone react-devtools via npx in a background process L473: try { L474: const { spawn } = require('child_process'); L475: const env = { ...process.env };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

main.jsView on unpkg · L471

bin/open-debugger.shView file

•path = bin/open-debugger.sh kind = build_helper sizeBytes = 373 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/open-debugger.shView on unpkg

Findings

3 High5 Medium4 Low

HighChild Processbin/cli.js

HighShell

HighRuntime Package Installmain.js

MediumDynamic Requirepreload.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/open-debugger.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

bin/cli.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2'use strict';

4const path = require('path');

5const { execSync, spawn } = require('child_process');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L4

7const C = {

8 reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',

9 green: '\x1b[32m', cyan: '\x1b[36m', yellow: '\x1b[33m', magenta: '\x1b[35m',

10};

12const args = process.argv.slice(2);

13const command = args[0] || 'start';

14const appDir = path.resolve(__dirname, '..');

16function printHelp() {

17 console.log();

18 console.log(C.bold + C.magenta + ' ReactoRadar' + C.reset + ' — React Native debugging tool');

19 console.log();

20 console.log(' Usage:');

21 console.log(` ${C.cyan}npx rn-debugger${C.reset} Launch the debugger app`);

22 console.log(` ${C.cyan}npx rn-debugger setup${C.reset} Install SDK into current RN project`);

23 console.log(` ${C.cyan}npx rn-debugger remove${C.reset} Remove SDK from current RN project`);

24 console.log(` ${C.cyan}npx rn-debugger help${C.reset} Show this help`);

preload.jsView file

Lines 1-22javascript

1'use strict';

3const { contextBridge, ipcRenderer } = require('electron');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

preload.jsView on unpkg · L2

5const registeredChannels = new Set();

main.jsView file

Lines 451-491javascript

451

453function setupIPC() {

454 ipcMain.on('open-cdp-target', (_, wsUrl) => {

455 // Always fetch fresh targets, then open

456 fetchCDPTargets((targets) => {

457 if

bin/open-debugger.shView file

•path = bin/open-debugger.sh kind = build_helper sizeBytes = 373 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/open-debugger.shView on unpkg