heroui-native-pro@1.0.0-beta.10
HeroUI React Native
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package has a real credential-gated postinstall download path, which warrants a warning until downloaded artifacts are independently assessed. No concrete malicious behavior is present in the inspected package files.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation
Impact
Remote Pro artifacts may be placed in the package directory during installation; their contents are not present here.
Mechanism
credential-gated remote artifact download
AI rationale
The package has a real credential-gated postinstall download path, which warrants a warning until downloaded artifacts are independently assessed. No concrete malicious behavior is present in the inspected package files.
Evidence
package.jsondist/postinstall/index.jsnode_modules/heroui-native-pro
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Install-time script invokes credential checks and download functions.
- Postinstall writes/downloads Pro artifacts into the installed package path.
Evidence against
- No shell execution, eval, file harvesting, or exfiltration is present in package source.
- Unauthenticated installs print login instructions and exit.
Behavioral surface
NoLicense
Source & flagged code
3 flaggedpackage.jsonView file
•scripts.postinstall = node ./dist/postinstall/index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg16"scripts": {
"postinstall": "node ./dist/postinstall/index.js"
}
Medium
Ai Review Evidence
Install-time script invokes credential checks and download functions.
package.jsonView on unpkg · L16dist/postinstall/index.jsView file
1const h=s(d(import.meta.url)),e=a(h,"../../");e.includes("node_modules")||process.exit(0);
Medium
Suspicious Lifecycle Evidence
Postinstall writes/downloads Pro artifacts into the installed package path.
dist/postinstall/index.jsView on unpkg · L1Findings
1 High2 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAi Review Evidencepackage.json
MediumSuspicious Lifecycle Evidencedist/postinstall/index.js
LowScripts Present
LowNo License
Affected versions and remediation
This report applies to heroui-native-pro@1.0.0-beta.10.
See all versions of heroui-native-pro for other recorded verdicts.
- Review the evidence and your use of heroui-native-pro@1.0.0-beta.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.