registry / @corva/create-app / 0.122.0
@corva/create-app@0.122.0
Create an app to use it in CORVA.AI
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource inspection shows a user-invoked Corva app scaffolding and release CLI, not malware. Static hints arise from normal templates, credential configuration, archiving, and package-aligned network deployment.
Static reason
One or more suspicious static signals were detected.
Trigger
Explicit create-corva-app release command.
Impact
Intended deployment of the user's selected project; no unsolicited install-time action found.
Mechanism
Authenticated project archive upload to Corva API.
AI rationale
Source inspection shows a user-invoked Corva app scaffolding and release CLI, not malware. Static hints arise from normal templates, credential configuration, archiving, and package-aligned network deployment.
Evidence
package.jsonbin/create-corva-app.cjslib/main.jslib/commands/create.jslib/flows/lib/api.jslib/flows/steps/release/get-config.jslib/flows/steps/release/upload-zip-to-corva.jscommon/node/.env
Network endpoints1
api.corva.ai
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The CLI can upload a user-selected project archive to Corva during the explicit release command.
- Release reads API credentials from CLI options, environment, or the target project's .env.
Evidence against
- No preinstall, install, postinstall, prepare, or uninstall lifecycle hook is declared.
- The bin shim only launches this package's CLI with inherited terminal I/O.
- Network use is a documented Corva API client invoked by release/rerun flows.
- The flagged .env files are scaffold templates with an empty API_KEY, not embedded credentials.
- No eval, dynamic code loading, credential harvesting, AI-agent control writes, or stealth persistence was found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedcommon/node/.envView file
1patternName = blocked_file
severity = critical
matchedText = common/node/.env
redactedSecretContext =
secretLikeLines = 2
L1: API_KEY=<redacted:0 empty>
L8: CACHE_URL=<redacted:22 token-like>
Critical
Critical Secret
Package contains a critical-looking secret pattern.
common/node/.envView on unpkg · L1common/python/MakefileView file
•path = common/python/Makefile
kind = build_helper
sizeBytes = 529
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
common/python/MakefileView on unpkgtemplates/scheduler_natural-time/python/test/app_test.pyView file
Findings
1 Critical2 High4 Medium5 Low
CriticalCritical Secretcommon/node/.env
HighPayload In Excluded Dirtemplates/scheduler_natural-time/python/test/app_test.py
HighSemantic Analysis Limitedlib/flows/lib/create-zip-archive.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpercommon/python/Makefile
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencelib/flows/steps/release/upload-zip-to-corva.js
Affected versions and remediation
This report applies to @corva/create-app@0.122.0.
See all versions of @corva/create-app for other recorded verdicts.
- Review the evidence and your use of @corva/create-app@0.122.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.