@nutui/nutui-react-taro@3.0.23-cpp
京东风格的轻量级移动端 React 组件库，支持一套代码生成 H5 和小程序
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an unresolved install-time execution risk, but the inspected source does not establish theft, destructive behavior, persistence, or a concrete malicious payload.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation runs the postinstall lifecycle hook.
Impact
The external CLI can run with the installing user's permissions; its behavior is not auditable from this package snapshot.
Mechanism
Postinstall child-process execution of an optional latest-tag dependency.
AI rationale
This is an unresolved install-time execution risk, but the inspected source does not establish theft, destructive behavior, persistence, or a concrete malicious payload.
Evidence
postinstall.js
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The automatic postinstall hook starts an external npm-usage-stats command.
- The command is supplied through an optional dependency pinned to the moving latest tag.
- Errors are silently suppressed, obscuring whether the external command ran or failed.
Evidence against
- The inspected package code contains no credential harvesting, file collection, persistence, or destructive action.
- The bundled eval calls belong to Lottie animation-expression handling, not install-time execution.
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
WildcardDependency
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = node postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/nutui.react.umd.jsView file
33918var scoped_bm_rt;
L33919: var expression_function = eval("[function _expression_function(){" + val + ";scoped_bm_rt=$bm_rt}]")[0];
L33920: var numKeys = property.kf ? data.k.length : 0;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/nutui.react.umd.jsFindings
1 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
MediumSuspicious Lifecycle Evidencepostinstall.js
LowScripts Present
LowEvaldist/nutui.react.umd.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @nutui/nutui-react-taro@3.0.23-cpp.
See all versions of @nutui/nutui-react-taro for other recorded verdicts.
- Review the evidence and your use of @nutui/nutui-react-taro@3.0.23-cpp before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.