registry / @moontra/moonui-pro / 3.4.45

@moontra/moonui-pro@3.4.45

Premium React components for MoonUI - Advanced UI library with 50+ pro components including performance, interactive, and gesture components

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 709 KB of source, external domains: api.anthropic.com, api.moonui.dev, api.openai.com, generativelanguage.googleapis.com, github.com, moonui.dev, nextjs.org, radix-ui.com, reactjs.org, ricostacruz.com, www.w3.org

Oversized source lightweight scan

dist/cdn/index.global.js2.91 MB file, sampled 256 KB

HighEntropyStringsUrlStringsgithub.comreactjs.orgricostacruz.comwww.w3.org

dist/index.mjs3.42 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsShellHighEntropyStringsUrlStringsapi.anthropic.comapi.moonui.devapi.openai.comgenerativelanguage.googleapis.comgithub.commoonui.devradix-ui.comwww.w3.org

Source & flagged code

4 flagged

package.jsonView file

Lines 59-99json

59 "require": {

60 "types": "./dist/vite-plugin.d.cts",

61 "default": "./dist/vite-plugin.cjs"

62 },

63 "default": "./dist/vite-plugin.mjs"

64 },

65 "./scripts/postinstall": {

66 "require": "./scripts/postinstall.cjs"

67 }

68 },

69 "scripts": {

70 "build": "tsup && node scripts/postbuild.js",

71 "build:dts": "tsup --dts",

72 "dev": "tsup --watch --sourcemap",

73 "clean": "rm -rf dist",

74 "lint": "eslint \"src/**/*.{ts,tsx}\"",

75 "test": "jest",

76 "test:watch": "jest --watch",

77 "test:coverage": "jest --coverage",

78 "prepublishOnly": "npm run clean && npm run build",

79 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L79

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L79

80 "pub": "npm version patch && npm run build && npm publish",

81 "pub:minor": "npm version minor && npm run build && npm publish",

82 "pub:major": "npm version major && npm run build && npm publish"

83 },

84 "keywords": [

85 "ui",

86 "components",

87 "react",

88 "typescript",

89 "moonui",

90 "premium",

91 "pro",

92 "virtual-list",

93 "performance",

94 "memory-efficient",

95 "animations",

96 "gestures",

97 "touch",

98 "interactive",

99 "3d-effects",

scripts/postinstall.cjsView file

Lines 1-29javascript

1#!/usr/bin/env node

3/**

4 * MoonUI Pro PostInstall Script

5 * Automatically validates license in production environments during npm install

6 */

8const fs = require('fs');

9const path = require(

dist/cdn/index.global.jsView file

•path = dist/cdn/index.global.js kind = oversized_source_file sizeBytes = 3051791 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cdn/index.global.jsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.cjsView file

9const path = require('path'); L10: const https = require('https'); L11: ... L20: const vercelIndicators = { L21: VERCEL: process.env.VERCEL === '1', L22: VERCEL_ENV: !!process.env.VERCEL_ENV, ... L37: process.env.NETLIFY === 'true' || L38: process.env.CI === 'true' || L39: process.env.MOONUI_AUTH_TOKEN // Special token for CI/CD ... L53: L54: console.log('[MoonUI Pro] Sending validation request with data:', postData); L55:

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.cjsView on unpkg · L9

dist/cdn/index.global.jsView file

•path = dist/cdn/index.global.js kind = oversized_source_file sizeBytes = 3051791 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cdn/index.global.jsView on unpkg

Findings

3 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilityscripts/postinstall.cjs

HighOversized Source Filedist/cdn/index.global.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 59-99json

59 "require": {

60 "types": "./dist/vite-plugin.d.cts",

61 "default": "./dist/vite-plugin.cjs"

62 },

63 "default": "./dist/vite-plugin.mjs"

64 },

65 "./scripts/postinstall": {

66 "require": "./scripts/postinstall.cjs"

67 }

68 },

69 "scripts": {

70 "build": "tsup && node scripts/postbuild.js",

71 "build:dts": "tsup --dts",

72 "dev": "tsup --watch --sourcemap",

73 "clean": "rm -rf dist",

74 "lint": "eslint \"src/**/*.{ts,tsx}\"",

75 "test": "jest",

76 "test:watch": "jest --watch",

77 "test:coverage": "jest --coverage",

78 "prepublishOnly": "npm run clean && npm run build",

79 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L79

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L79

80 "pub": "npm version patch && npm run build && npm publish",

81 "pub:minor": "npm version minor && npm run build && npm publish",

82 "pub:major": "npm version major && npm run build && npm publish"

83 },

84 "keywords": [

85 "ui",

86 "components",

87 "react",

88 "typescript",

89 "moonui",

90 "premium",

91 "pro",

92 "virtual-list",

93 "performance",

94 "memory-efficient",

95 "animations",

96 "gestures",

97 "touch",

98 "interactive",

99 "3d-effects",

scripts/postinstall.cjsView file

Lines 1-29javascript

1#!/usr/bin/env node

3/**

4 * MoonUI Pro PostInstall Script

5 * Automatically validates license in production environments during npm install

6 */

8const fs = require('fs');

9const path = require(

dist/cdn/index.global.jsView file

•path = dist/cdn/index.global.js kind = oversized_source_file sizeBytes = 3051791 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cdn/index.global.jsView on unpkg