npm JavaScript analyzed 1.10.7

react-native-ai-devtools

v1.10.7

ExecBro — MCP server giving AI agents eyes and hands into React Native apps. Logs, REPL, state inspection, tap, screenshot.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 2 tools

transport stdio · streamable-http · http counts 2 tools · 0 res · 0 prompts permission surface via code analysis

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v1.10.7 · analyzer v33 · 4w ago

suspicious endpoint us.i.posthog.com (telemetry) expected for this server's purpose package/build/core/posthog.js :6 const host = "https://us.i.posthog.com";

code evidence v1.10.7 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 228

fs (weak) package/build/__tests__/unit/buildToken.test.js :1 import { readFileSync } from "fs";
fs package/build/core/android.js :1 import { existsSync } from "fs";
fs package/build/core/config.js :1 import { readFileSync, existsSync } from "fs";
fs package/build/core/feedback.js :1 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
fs package/build/core/fingerprint.js :4 import { readFileSync, existsSync } from "fs";
fs package/build/core/ios.js :3 import { existsSync } from "fs";
fs package/build/core/license.js :1 import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync } from "fs";
fs package/build/core/ocr.js :3 import { writeFile, unlink } from "fs/promises";
fs package/build/core/paths.js :1 import { existsSync, renameSync } from "fs";
fs package/build/core/posthog.js :2 import { existsSync, readFileSync } from "fs";
fs package/build/core/telemetry.js :2 import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync } from "fs";
fs package/build/tools/accountTools.js :5 import { existsSync, unlinkSync } from "fs";

show 1 more

fs package/build/tools/metaTools.js :2 import { existsSync, unlinkSync } from "fs";

shell (weak) package/build/__tests__/helpers/tap-test-helpers.js :12 const { execSync } = await import("child_process");
shell (weak) package/build/__tests__/unit/fingerprint.test.js :3 // or transitive deps consume (e.g. child_process.exec) keeps working. Using
shell package/build/core/exec.js :1 import { exec } from "node:child_process";
shell package/build/core/fingerprint.js :3 import { execSync } from "child_process";
shell package/build/core/ios.js :1 import { execFile } from "child_process";
shell package/build/core/ocr.js :7 import { spawn } from "child_process";

net (weak) package/build/__tests__/unit/executor.test.js :55 const result = validateAndPreprocessExpression("async () => { await fetch() }");
net package/build/core/bundle.js :286 const response = await fetch(`http://localhost:${port}/status`);
net package/build/core/failureArtifact.js :45 const res = await fetch(url, {
net package/build/core/license.js :136 const response = await fetch(`${VALIDATION_ENDPOINT}/api/license/validate`, {
net package/build/core/metro.js :1 import * as net from "net";
net package/build/core/ocr.js :170 response = await fetch(`${OCR_ENDPOINT}/ocr`, {
net package/build/core/telemetry.js :640 fetch(TELEMETRY_ENDPOINT, {
net package/build/index.js :5 import { createServer as createHttpServer } from "node:http";
net package/build/tools/accountTools.js :34 const response = await fetch(`${API_URL}/api/accounts/activate`, {
net package/build/tools/executionTools.js :16 "BAD examples: `async () => { await fetch(...) }`, `require('react-native')`\n" +

show 4 more