heroui-native-pro@1.0.0-beta.9
HeroUI React Native
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe lifecycle downloader is documented and no concrete malicious action is present locally, but it fetches unreviewable install-time payloads. Treat as a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall while installed under node_modules with HeroUI credentials available
Impact
Unreviewed remote artifacts may be written into the installed package.
Mechanism
credential-gated remote artifact download
AI rationale
The lifecycle downloader is documented and no concrete malicious action is present locally, but it fetches unreviewable install-time payloads. Treat as a warning rather than a block.
Evidence
package.jsondist/postinstall/index.jsREADME.md../../ (package root)
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- package.json runs dist/postinstall/index.js on install.
- The hook calls heroui-pro downloadFromCI/downloadFromCLI when a CI token or keyring credential exists.
- Downloaded artifacts are not present in this package for source review.
Evidence against
- README.md documents this as the expected licensed-artifact installation flow.
- The hook exits outside node_modules and otherwise only prints login/error guidance.
- No local shell execution, eval, credential exfiltration, destructive action, or AI-agent config write was found.
Behavioral surface
NoLicense
Source & flagged code
1 flaggedpackage.jsonView file
•scripts.postinstall = node ./dist/postinstall/index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgFindings
1 High2 Low
HighInstall Time Lifecycle Scriptspackage.json
LowScripts Present
LowNo License
Affected versions and remediation
This report applies to heroui-native-pro@1.0.0-beta.9.
See all versions of heroui-native-pro for other recorded verdicts.
- Review the evidence and your use of heroui-native-pro@1.0.0-beta.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.