nativekeel weekly downloads statistics

NativeKeel

Health check for React Native and Expo apps. One command, no install, no account:

npx nativekeel

No terminal handy? Paste your package.json at nativekeel.com/check: the same dependency checks and upgrade plan, run in your browser.

Works with GitHub Actions (a quality gate comment on every pull request), SonarQube (findings in your existing projects and quality gate) and AI coding agents (MCP server for Claude Code, Codex and Cursor). Several apps? npx nativekeel fleet puts them on one page.

What's new in 0.1.115: the SonarQube export no longer fails on findings located as file:line and maps issues to their real file; every finding says what its evidence rests on; the HTML report is grouped by what to do; exceptions can expire (until); measured accuracy. 0.1.114: Supabase policy checks read far more real migrations (28 of 45 open-source databases, up from 8): pg_dump settings, cron calls, column changes and DO … CREATE POLICY blocks no longer stop them. 0.1.113: script injection in GitHub Actions (an issue or pull request title pasted into a run: script in a workflow that has secrets). 0.1.112: "gate" in .nativekeel.json chooses which checks can fail the build; findings in code the app never imports are labelled and lowered. 0.1.111: fewer false alarms from a production app review: inherited AppDelegate window, Folly flags set in the Podfile, release logging silenced by a project's own Babel plugin or a run-time no-op, server-only moment advisories; the 16 KB finding says which build it measured. 0.1.110: database reads opened too widely (Firestore collections of people or private records readable by any signed-in user, Supabase tables of people with email or phone readable by anyone) and public storage buckets with private names. 0.1.109: GitHub Actions workflows that run a fork's pull request with your secrets (pull_request_target + checkout + run), the mistake that exposed Jellyfin's App Store credentials. 0.1.108: URLs trusted after a text comparison (startsWith('https://site.com') also accepts site.com.attacker.dev), subscriptions or roles the app writes to its own database, login tokens sent to other sites; and cleanup: source files nothing imports, unreferenced images, backup copies, debugger statements. 0.1.107: Sentry auth tokens, secrets in an Expo app.json reported as shipped (Expo embeds the config), and more server secrets read by app code (AWS, Cloudinary, Twilio, email APIs, any *_SECRET); checked against 10 published vulnerabilities (found 5 → 7). 0.1.106: keys added at build time (EAS or CI environment variables) are found by scanning the built app's JavaScript bundle, Hermes bytecode included: automatically under android/app/build, or --artifact app.apk. 0.1.105: timers and listeners that can never be stopped, request loops, and credentials in release logs; tested against an app with 41 known problems (found: 59% → 76%). 0.1.104: in the HTML report, outdated packages are listed right after the other low findings and the low card says how many there are. 0.1.103: files in .gitignore no longer produce code findings (secret checks still read them), Metro's drop_console is recognized, and react-native-gesture-handler buttons get the accessibility checks. 0.1.102: every finding shows its id (for .nativekeel.json), exclude leaves out folders that are not part of the app, files encrypted with git-crypt are no longer reported as committed secrets, and logging inside if (__DEV__) is no longer counted. 0.1.101: fewer false alarms for React header imports that only compile on the old architecture, and the React Native 0.88 library readiness list: 18 of the 590 most used native libraries break on 0.87/0.88. 0.1.100: clearer MCP tools: every parameter documented, standard read-only annotations on all eight tools. 0.1.99: backend admin credentials compiled into the app (Supabase service_role, Hasura admin secret, Firebase service accounts, database passwords, Stripe secret key) and server-only SDKs imported by app code. 0.1.98: fewer false alarms: React header imports in an app's own AppDelegate or bridging header are no longer reported on React Native 0.87 (they resolve in the app target; only libraries fail). 0.1.97: render loops ("Too many re-renders", "Maximum update depth exceeded") found with file and line: handlers called instead of passed, effects that set state on every run. 0.1.96: a React Native version that does not match the Expo SDK is reported (a common cause of build failures and launch crashes). 0.1.95: Google Play's API 36 requirement (extension ends 1 November): the edge-to-edge opt-out Android 16 ignores, and orientation locks tablets and foldables ignore. 0.1.94: team panel (closed beta): --upload sends a scan summary (no code) to your team's page with history and trends; GitHub Action input panel-token. Live demo. 0.1.93: --sonar <file> puts NativeKeel findings inside SonarQube (generic issue import, tested on Community Build 26.10), also as the GitHub Action's sonar input (setup). 0.1.92: React Native 0.88 and Expo SDK 58 are stable: the UIScene finding gives 0.88's official SceneDelegate steps, and InputAccessoryView (deprecated in 0.88) is reported with its replacement. 0.1.91: npx nativekeel fleet ~/clients --base last-month.json shows what changed per app since an earlier run (ratings and critical/high counts), plus new and removed apps; compare includes ratings. 0.1.90: pull request comments start with a quality gate and show the A–E ratings with what changed; a committed .nativekeel.json holds…