heroui-native-pro@1.0.0-beta.12
HeroUI React Native
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe default install hook performs authenticated network activity and reports a hashed project identifier, while the downloader and endpoint constants are substantially obfuscated. The evidence does not show an unrelated destination or credential exfiltration, so this warrants a warning rather than a malicious verdict.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation, when the package is installed outside node_modules and CI or saved HeroUI credentials are available.
Impact
Project metadata is reported during installation without an explicit per-install consent step. The available source does not establish credential theft or an unrelated destination.
Mechanism
The hook selects a CI or keyring credential and calls the dependency's downloader, which sends requests with a hashed project name header.
AI rationale
The default install hook performs authenticated network activity and reports a hashed project identifier, while the downloader and endpoint constants are substantially obfuscated. The evidence does not show an unrelated destination or credential exfiltration, so this warrants a warning rather than a malicious verdict.
Evidence
package.jsondist/postinstall/index.js.lpm-dependency-evidence-3c204c23-0e84-4076-aae1-1bf29289d187/1/npm-linux/dist/cdn/download.js.lpm-dependency-evidence-3c204c23-0e84-4076-aae1-1bf29289d187/1/npm-linux/dist/consts.js
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs dist/postinstall/index.js automatically after installation.
- The postinstall hook calls HeroUI Pro's CI or CLI artifact downloader when credentials are available.
- The downloader adds a hashed project name to request headers; its endpoint and surrounding behavior are heavily obfuscated.
Evidence against
- The package describes itself as HeroUI React Native, and the hook's stated purpose is to finish installing that product.
- The downloader's project identifier is hashed rather than sent as a readable project name.
- No source evidence establishes that credentials are sent outside the HeroUI service or that the downloaded artifact is unrelated.
Behavioral surface
NoLicense
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = node ./dist/postinstall/index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg16"scripts": {
"postinstall": "node ./dist/postinstall/index.js"
},
"dependencies": {
"c
Medium
Suspicious Lifecycle Evidence
package.json runs dist/postinstall/index.js automatically after installation.
package.jsonView on unpkg · L16dist/postinstall/index.jsView file
1;import{downloadFromCI as p,downloadFromCLI as u}from"heroui-pro/cdn";import{getCredentials as g}from"heroui-pro/auth/keyring";import{getCIToken as f}from"heroui-pro/auth/ci";const h=s(d(import.meta.url)),e=a(h,"../../");e.includes("node_modules")||process.exit(0);const o=c["react-native"]
Medium
Findings
1 High3 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Lifecycle Evidencedist/postinstall/index.js
MediumAi Review Evidence.lpm-dependency-evidence-3c204c23-0e84-4076-aae1-1bf29289d187/1/npm-linux/dist/cdn/download.js
LowScripts Present
LowNo License
Affected versions and remediation
This report applies to heroui-native-pro@1.0.0-beta.12.
See all versions of heroui-native-pro for other recorded verdicts.
- Review the evidence and your use of heroui-native-pro@1.0.0-beta.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.