@heroui-pro/react@1.0.0-beta.10
HeroUI React
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe package defines an automatic postinstall hook, but the inspected flow gates product downloads on recognized credentials and otherwise exits. No concrete malicious behavior was established, so this is a guarded first-party product installation flow.
Decision evidence
public snapshot- package.json runs dist/postinstall/index.js automatically after install.
- The script exits when the package path contains node_modules, then otherwise chooses authenticated CI download or credential-backed CLI download; without credentials it prints sign-in instructions.
- The inspected postinstall flow requires an existing CI token or stored credentials before downloading, and otherwise exits without downloading.
- No credential harvesting, unrelated file mutation, or direct network endpoint was established in the inspected source.
Source & flagged code
4 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgpackage.json runs dist/postinstall/index.js automatically after install.
package.jsonView on unpkg · L17The script exits when the package path contains node_modules, then otherwise chooses authenticated CI download or credential-backed CLI download; without credentials it prints sign-in instructions.
Findings
Affected versions and remediation
This report applies to @heroui-pro/react@1.0.0-beta.10.
See all versions of @heroui-pro/react for other recorded verdicts.
- Review the evidence and your use of @heroui-pro/react@1.0.0-beta.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.