registry / @corva/create-app / 0.126.0
@corva/create-app@0.126.0
Create an app to use it in CORVA.AI
AI Security Review
scanned 27d ago · by lpm-firewall-aiInspected source shows no install-time trigger or concrete attack behavior. The suspicious file findings are explained by an empty/template environment file, an ordinary app test, and explicit template copying by the CLI.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the create-corva-app CLI to create or manage an app.
Impact
The reviewed behavior creates app files and makes package-aligned API requests; no malicious effect was established.
Mechanism
The create command copies a selected template into the requested directory; the inspected API client uses a Corva API host.
AI rationale
Inspected source shows no install-time trigger or concrete attack behavior. The suspicious file findings are explained by an empty/template environment file, an ordinary app test, and explicit template copying by the CLI.
Evidence
lib/commands/create.js
Network endpoints1
api.corva.ai
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no preinstall, install, or postinstall hook; its scripts are development and release commands.
- common/node/.env contains an empty API key and template variables, with Corva service URLs.
- The flagged Python test constructs a Corva event and calls the app handler; it contains no payload behavior.
- The CLI copies selected app templates into the requested project directory when its create command runs.
- The API client sends requests to a Corva API host and uses the supplied API key or auth token.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedcommon/node/.envView file
1patternName = blocked_file
severity = critical
blockedFile = common/node/.env
redactedSecretContext =
secretLikeLines = 2
L1: API_KEY=<redacted:0 empty>
L8: CACHE_URL=<redacted:22 token-like>
Critical
Critical Secret
Package contains a critical-looking secret pattern.
common/node/.envView on unpkg · L1common/python/MakefileView file
•path = common/python/Makefile
kind = build_helper
sizeBytes = 529
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
common/python/MakefileView on unpkgtemplates/scheduler_natural-time/python/test/app_test.pyView file
Findings
1 Critical3 High4 Medium4 Low
CriticalCritical Secretcommon/node/.env
HighPayload In Excluded Dirtemplates/scheduler_natural-time/python/test/app_test.py
HighSemantic Analysis Limitedlib/commands/create.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltalib/commands/create.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpercommon/python/Makefile
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @corva/create-app@0.126.0.
See all versions of @corva/create-app for other recorded verdicts.
- Review the evidence and your use of @corva/create-app@0.126.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.