Official Package Audit
Complete security audit results for the heroui-pro npm package
This article is generated by CC powered by GLM-5-turbo, based on project source code and runtime memory.
Audit Scope
| Package | Version | Type |
|---|---|---|
heroui-pro | 1.0.0-beta.9 | CLI tool + shared library for auth/CDN/cache |
@heroui-pro/react | 1.0.0-beta.3 | React Pro components (shell package, downloaded via postinstall) |
heroui-native-pro | 1.0.0-beta.3 | React Native Pro components (same as above) |
Key Findings
No third-party telemetry SDKs found, no active data exfiltration behavior detected. This is a commercial licensing and distribution system for a paid component library.
Obfuscation and Deobfuscation
5 files use RC4 + base64 obfuscation, and all 327 encrypted strings were successfully decrypted automatically.
Deobfuscated files:
| File | Description |
|---|---|
consts.deobfuscated.js | Constant definitions |
auth/keyring.deobfuscated.js | Keyring operations |
auth/session.deobfuscated.js | Session management |
auth/ci.deobfuscated.js | CI authentication flow |
cdn/download.deobfuscated.js | CDN download logic |
Deobfuscation results are saved in the heroui-pro-analysis/ directory.
Implicit Tracking Mechanisms
Although there is no third-party telemetry SDK, the following implicit tracking capabilities exist:
1. Project Fingerprinting
Each request sends the header X-HeroUI-Project: sha256(projectName).slice(0, 16), allowing the server to count unique projects.
2. Client Identification
User-Agent: heroui-pro-cli/1.0.0-beta.4X-HeroUI-Client-Versionheader
3. Authentication Identity
GitHub handle + JWT token are associated with every download request, enabling tracking of individual user usage patterns.
4. Dynamic Code Delivery
The npm package itself is a shell; the actual component code is fetched from a remote server via postinstall. This means:
- Code cannot be pinned through npm version locking
- The actual code installed may differ each time
- Upstream can change the distributed code content at any time
External Communication
| Target | Purpose | Authentication Info |
|---|---|---|
api.heroui.pro | Authentication, CDN downloads | GitHub token / CI token |
registry.npmjs.org | Version check | None (3-second timeout) |
| GitHub OAuth | SSE callback | GitHub OAuth token |
Local Storage
| Path | Content | Permissions |
|---|---|---|
~/.config/heroui-pro/credentials.json | GitHub handle + JWT | 0600 |
| System keyring (libsecret) | Same as above (preferred if available) | — |
~/.heroui/cache/<slug>/<version>/ | Component cache | — |
Credential files use 0600 permissions (readable and writable only by the owner).
Risk Assessment
| Risk | Level | Description |
|---|---|---|
| Dynamic code delivery | Medium | npm package is a shell; actual code is controlled by upstream |
| Project fingerprint tracking | Low | Only sends a hash of the project name, not user identity information |
| Authentication association | Low | Uses GitHub identity, which is normal behavior for a paid product |
| Local credential storage | Low | Uses standard 0600 permissions + system keyring |
How is this guide?
Last updated on