registry / Telemetry / heroui-native-pro / 1.0.0-beta.12.1

heroui-native-pro@1.0.0-beta.12.1

HeroUI React Native

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The automatic postinstall downloader attaches a hash derived from the current project name to outgoing request headers. Install-time telemetry is enabled by default, so this warrants a warning; the available source does not establish malicious credential exfiltration.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation when a CI token or saved HeroUI credential is available.

Impact

The receiving service can use the hashed project name to identify or correlate installs. The default endpoint is obfuscated in the reviewed dependency source.

Mechanism

The hook calls the HeroUI downloader, which hashes the project name and adds that value to headers used by its HTTP request helpers.

AI rationale

Evidence

package.jsondist/postinstall/index.js.lpm-dependency-evidence-4654097e-074b-487d-93c1-5b7c1d0bd490/1/npm-linux/dist/cdn/download.js

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest runs dist/postinstall/index.js automatically during installation.
The postinstall script invokes the product download flow when a CI token or saved credential is available; otherwise it displays sign-in instructions and exits.
The downloader derives a truncated hash from the current project name and conditionally adds it to request headers.
The downloader sends the HeroUI auth token and product version in a request body for the gated product download.

Evidence against

The package identifies itself as HeroUI React Native, and its postinstall flow is for installing that product.
The credentialed download is consistent with obtaining a licensed product asset; the reviewed code does not establish credential theft or an unrelated collector.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 1 file(s), 1.35 KB of source

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node ./dist/postinstall/index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

16"scripts": { "postinstall": "node ./dist/postinstall/index.js" }, "dependencies": { "c

Medium

Suspicious Lifecycle Evidence

The manifest runs dist/postinstall/index.js automatically during installation.

package.jsonView on unpkg · L16

dist/postinstall/index.jsView file

13))},C=async()=>{if(f())return await p(o,e);if(await g())return await u(o,e);b(),process.exit(0)};C().catch(i=>{console.log(n.red.bold(`Access denied: You don't have permission to i

Medium

Suspicious Lifecycle Evidence

The postinstall script invokes the product download flow when a CI token or saved credential is available; otherwise it displays sign-in instructions and exits.

Findings

1 High4 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumSuspicious Lifecycle Evidencepackage.json

MediumSuspicious Lifecycle Evidencedist/postinstall/index.js

MediumAi Review Evidence.lpm-dependency-evidence-4654097e-074b-487d-93c1-5b7c1d0bd490/1/npm-linux/dist/cdn/download.js

LowScripts Present

LowNo License

Affected versions and remediation

This report applies to heroui-native-pro@1.0.0-beta.12.1.

See all versions of heroui-native-pro for other recorded verdicts.

Review the evidence and your use of heroui-native-pro@1.0.0-beta.12.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-30 22:02:16.771Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Telemetry / heroui-native-pro / 1.0.0-beta.12.1

heroui-native-pro@1.0.0-beta.12.1

HeroUI React Native

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation when a CI token or saved HeroUI credential is available.

Impact

The receiving service can use the hashed project name to identify or correlate installs. The default endpoint is obfuscated in the reviewed dependency source.

Mechanism

The hook calls the HeroUI downloader, which hashes the project name and adds that value to headers used by its HTTP request helpers.

AI rationale

Evidence

package.jsondist/postinstall/index.js.lpm-dependency-evidence-4654097e-074b-487d-93c1-5b7c1d0bd490/1/npm-linux/dist/cdn/download.js

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest runs dist/postinstall/index.js automatically during installation.
The postinstall script invokes the product download flow when a CI token or saved credential is available; otherwise it displays sign-in instructions and exits.
The downloader derives a truncated hash from the current project name and conditionally adds it to request headers.
The downloader sends the HeroUI auth token and product version in a request body for the gated product download.

Evidence against

The package identifies itself as HeroUI React Native, and its postinstall flow is for installing that product.
The credentialed download is consistent with obtaining a licensed product asset; the reviewed code does not establish credential theft or an unrelated collector.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 1 file(s), 1.35 KB of source

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node ./dist/postinstall/index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

16"scripts": { "postinstall": "node ./dist/postinstall/index.js" }, "dependencies": { "c

Medium

Suspicious Lifecycle Evidence

The manifest runs dist/postinstall/index.js automatically during installation.

package.jsonView on unpkg · L16

dist/postinstall/index.jsView file

13))},C=async()=>{if(f())return await p(o,e);if(await g())return await u(o,e);b(),process.exit(0)};C().catch(i=>{console.log(n.red.bold(`Access denied: You don't have permission to i

Medium

Suspicious Lifecycle Evidence

The postinstall script invokes the product download flow when a CI token or saved credential is available; otherwise it displays sign-in instructions and exits.

Findings

1 High4 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumSuspicious Lifecycle Evidencepackage.json

MediumSuspicious Lifecycle Evidencedist/postinstall/index.js

MediumAi Review Evidence.lpm-dependency-evidence-4654097e-074b-487d-93c1-5b7c1d0bd490/1/npm-linux/dist/cdn/download.js

LowScripts Present

LowNo License

Affected versions and remediation

This report applies to heroui-native-pro@1.0.0-beta.12.1.

See all versions of heroui-native-pro for other recorded verdicts.

Review the evidence and your use of heroui-native-pro@1.0.0-beta.12.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-30 22:02:16.771Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.