@heroui-pro/react@1.0.0-beta.11
HeroUI React
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe postinstall behavior fits the package’s stated artifact-delivery purpose, and I found no evidence of credential theft or unrelated actions. However, an authenticated install sends a project-derived identifier without a disclosed telemetry choice, so this warrants a warning under the install-time telemetry rule.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation when HEROUI_AUTH_TOKEN is set or saved HeroUI credentials are available.
Impact
The package's service can receive a stable, project-derived identifier during installation without a disclosed telemetry choice.
Mechanism
The download client hashes the project name and adds the result to custom request headers while fetching product artifacts. The endpoint defaults are obfuscated in the inspected dependency source, so the exact host could not be confirmed.
AI rationale
The postinstall behavior fits the package’s stated artifact-delivery purpose, and I found no evidence of credential theft or unrelated actions. However, an authenticated install sends a project-derived identifier without a disclosed telemetry choice, so this warrants a warning under the install-time telemetry rule.
Evidence
package.jsondist/postinstall/index.js.lpm-dependency-evidence-edbf84e9-c203-4719-9e6c-a6f343a6555a/1/npm-linux/dist/cdn/download.js@heroui-pro/react package directory, passed as the artifact installation directory
Network endpoints2
HEROUI_SESSION_API_URL (environment-configurable; default is obfuscated in source)Product artifact URL (obfuscated in source)
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest runs dist/postinstall/index.js during installation.
- The hook downloads the React Pro artifact when a CI token or saved HeroUI credentials are available; otherwise it displays login instructions and exits.
- The download client hashes the current project name and adds the resulting identifier to its request headers.
Evidence against
- The README describes this package as a premium component library whose artifacts are downloaded during installation using a HeroUI login or CI token.
- The credential flow is used for that artifact download; I found no evidence that credentials are sent to a third-party collector.
Behavioral surface
HighEntropyStrings
NoLicense
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = node ./dist/postinstall/index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg17"postinstall": "node ./dist/postinstall/index.js"
},
"dependencies": {
"chalk": "5.6.2",
"heroui-pro": "^1.0.0-alpha.1"
}
}
Medium
Suspicious Lifecycle Evidence
The manifest runs dist/postinstall/index.js during installation.
package.jsonView on unpkg · L17dist/postinstall/index.jsView file
12ine(l)}.
`))},C=async()=>{if(s())return await u(n,i);if(await h())return await g(n,i);b(),process.exit(0)};C().catch(e=>{if(s()){console.log(o.red.bold("Package download failed with HEROUI_AUTH_TOKEN.")),console.log(o.red(`Check the token with your team owner, or contact ${t}. CLI login is not required.`)),console.log(o.gray(e.message)),process.exit(1);return}console.log(o.red.bold(`Acce
Findings
1 High4 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencedist/postinstall/index.js
MediumAi Review Evidence.lpm-dependency-evidence-edbf84e9-c203-4719-9e6c-a6f343a6555a/1/npm-linux/dist/cdn/download.js
MediumAi Review Evidence.lpm-dependency-evidence-edbf84e9-c203-4719-9e6c-a6f343a6555a/1/npm-linux/dist/cdn/download.js
LowScripts Present
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to @heroui-pro/react@1.0.0-beta.11.
See all versions of @heroui-pro/react for other recorded verdicts.
- Review the evidence and your use of @heroui-pro/react@1.0.0-beta.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.