registry / @corva/create-app / 0.128.0
@corva/create-app@0.128.0
Create an app to use it in CORVA.AI
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe suspicious scanner hints resolve to ordinary generator behavior, a sample test, and development environment defaults. I found no install-time execution, embedded credential, or concrete malicious behavior in the inspected source.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the create-corva-app command and selects options for a new project.
Impact
No confirmed attack surface was established from the inspected source.
Mechanism
The generator copies templates into the target project; for UI apps it checks the package registry for the latest version.
AI rationale
The suspicious scanner hints resolve to ordinary generator behavior, a sample test, and development environment defaults. I found no install-time execution, embedded credential, or concrete malicious behavior in the inspected source.
Evidence
package.jsonbin/create-corva-app.cjslib/commands/create.jslib/helpers/cli-version.jscommon/node/.envtemplates/scheduler_natural-time/python/test/app_test.py
Network endpoints1
registry.npmjs.org/@corva/create-app/latest
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a user-run project generator and has no install lifecycle hook.
- The flagged Python file is a short test that constructs a sample event and invokes the app runner.
- The generator checks the npm registry only when creating a UI app; it uses that response to compare versions.
- The generator’s dependency installation is conditional on the user-selected option.
- The flagged environment file has an empty API key and references variable placeholders.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedcommon/node/.envView file
1patternName = blocked_file
severity = critical
blockedFile = common/node/.env
redactedSecretContext =
secretLikeLines = 2
L1: API_KEY=<redacted:0 empty>
L8: CACHE_URL=<redacted:22 token-like>
Critical
Critical Secret
Package contains a critical-looking secret pattern.
common/node/.envView on unpkg · L1common/python/MakefileView file
•path = common/python/Makefile
kind = build_helper
sizeBytes = 529
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
common/python/MakefileView on unpkgtemplates/scheduler_natural-time/python/test/app_test.pyView file
Findings
1 Critical3 High4 Medium4 Low
CriticalCritical Secretcommon/node/.env
HighPayload In Excluded Dirtemplates/scheduler_natural-time/python/test/app_test.py
HighSemantic Analysis Limitedlib/commands/create.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltalib/commands/create.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpercommon/python/Makefile
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @corva/create-app@0.128.0.
See all versions of @corva/create-app for other recorded verdicts.
- Review the evidence and your use of @corva/create-app@0.128.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.