@nutui/nutui-react-taro@4.0.0-beta.7
京东风格的轻量级移动端 React 组件库，支持一套代码生成 H5 和小程序
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package directly causes automatic execution of code from an unpinned external optional dependency, but the snapshot does not establish theft, persistence, or destructive behavior. This is a real unresolved install-time capability rather than confirmed malware.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing the package with lifecycle scripts enabled.
Impact
The external CLI receives installer privileges, creating unresolved supply-chain and telemetry risk.
Mechanism
Postinstall execution of an externally supplied telemetry-named CLI.
AI rationale
The package directly causes automatic execution of code from an unpinned external optional dependency, but the snapshot does not establish theft, persistence, or destructive behavior. This is a real unresolved install-time capability rather than confirmed malware.
Evidence
package.jsonpostinstall.js
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Its postinstall hook launches the external npm-usage-stats command automatically during installation.
- The executable comes from an optional dependency using the unpinned latest tag, so the code run at install time is not present or fixed in this snapshot.
- The hook suppresses errors, reducing visibility if the external command fails.
Evidence against
- The package snapshot contains no credential harvesting, file collection, destructive action, or direct network client in its own lifecycle script.
- Bundle network strings are component image assets, and the eval occurrences are in bundled animation-expression code rather than the installer.
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
WildcardDependency
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = node postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/nutui.react.umd.jsView file
33367var scoped_bm_rt;
L33368: var expression_function = eval("[function _expression_function(){" + val + ";scoped_bm_rt=$bm_rt}]")[0];
L33369: var numKeys = property.kf ? data.k.length : 0;
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/nutui.react.umd.jsFindings
1 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
MediumSuspicious Lifecycle Evidencepostinstall.js
LowScripts Present
LowEvaldist/nutui.react.umd.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @nutui/nutui-react-taro@4.0.0-beta.7.
See all versions of @nutui/nutui-react-taro for other recorded verdicts.
- Review the evidence and your use of @nutui/nutui-react-taro@4.0.0-beta.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.