heroui-native-pro
HeroUI React Native
This report shows the evidence for heroui-native-pro@1.0.0-beta.12.1. 0 of 5 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe automatic postinstall downloader attaches a hash derived from the current project name to outgoing request headers. Install-time telemetry is enabled by default, so this warrants a warning; the available source does not establish malicious credential exfiltration.
Decision evidence
public snapshot- The manifest runs dist/postinstall/index.js automatically during installation.
- The postinstall script invokes the product download flow when a CI token or saved credential is available; otherwise it displays sign-in instructions and exits.
- The downloader derives a truncated hash from the current project name and conditionally adds it to request headers.
- The downloader sends the HeroUI auth token and product version in a request body for the gated product download.
- The package identifies itself as HeroUI React Native, and its postinstall flow is for installing that product.
- The credentialed download is consistent with obtaining a licensed product asset; the reviewed code does not establish credential theft or an unrelated collector.
Source & flagged code
5 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe manifest runs dist/postinstall/index.js automatically during installation.
package.jsonView on unpkg · L16The postinstall script invokes the product download flow when a CI token or saved credential is available; otherwise it displays sign-in instructions and exits.
Findings
Affected versions and remediation
This report applies to heroui-native-pro@1.0.0-beta.12.1.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of heroui-native-pro@1.0.0-beta.12.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.