Five Number tools
Five Number tools › SPFx Package Inspector

SPFx Package Inspector

Check an SPFx package before you approve it. Drop an .sppkg file to see the API permissions it requests, the domains its code talks to, how it deploys, and anything that looks like a secret.

Your package never leaves your browser. It is unzipped and checked in this tab.
Drop a .sppkg file here
or
.sppkg only · up to 100 MB · nothing is uploaded

What it checks

API permission requestsEvery Graph or custom API scope the package asks for, rated by how much data it reaches.
Domains in the codeHosts found in the shipped JavaScript, split into Microsoft, third-party, and documentation links.
Deployment scopeTenant-wide availability, extensions that switch on for every site, and code loaded from outside the package.
Secrets and keysStrings shaped like client secrets, storage keys, SAS tokens, private keys and API keys. Values are masked.
ComponentsEvery web part, extension and library in the package, with its ID, version and supported hosts.
Bundle hygieneBundle size, source maps, and old build files left in the package.

Findings

API permission requests

Domains in the code

Disclaimer

These tools are provided free and as-is, with no warranty of any kind. Results are best-effort and can be incomplete or out of date, so always verify them against official Microsoft documentation before you act on them.

This inspector reads a package statically. A clean report does not prove a package is safe, and a finding does not prove it is malicious. Use it to decide what to ask the vendor or developer.

fivenumber tools is an independent project and is not affiliated with, sponsored by, or endorsed by Microsoft. Microsoft, Microsoft 365, SharePoint, Entra, OneDrive and Copilot are trademarks of the Microsoft group of companies.

Send feedback

Found this useful, or hit a snag? Tell me what worked and what would make it better. Your note comes straight to me.

Thanks, your feedback was sent.

I read every note. If you left your email, I may follow up.