registry / @corva/create-app / 0.128.1
@corva/create-app@0.128.1
Create an app to use it in CORVA.AI
AI Security Review
scanned 8d ago · by lpm-firewall-aiSource inspection found a user-invoked app generator, a prompted cleanup for nonempty output directories, and package-aligned npm and Corva API requests. The flagged environment file contains placeholders, the test path contains an ordinary app test, and no concrete attack behavior was identified.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the create-corva-app command; generated dependency installation requires the install option.
Impact
No confirmed attack impact; the observed network activity supports version checking and Corva app operations.
Mechanism
The CLI creates project files, checks its version at npm for UI apps, and uses Corva API URLs for app operations. It does not show an unrelated credential recipient or an automatic package install hook.
AI rationale
Source inspection found a user-invoked app generator, a prompted cleanup for nonempty output directories, and package-aligned npm and Corva API requests. The flagged environment file contains placeholders, the test path contains an ordinary app test, and no concrete attack behavior was identified.
Evidence
package.jsonbin/create-corva-app.cjslib/commands/create.jslib/helpers/cli-version.jslib/flows/lib/api.jscommon/node/.envtemplates/scheduler_natural-time/python/test/app_test.py
Network endpoints2
registry.npmjs.org/@corva/create-app/latestapi.corva.ai
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a command-line entrypoint and lists development and release scripts, with no package install hook.
- The inspected dependency manifests show ordinary library entrypoints and test scripts; archiver provides archive creation and Commander exposes CLI helpers.
- The create command writes a project in the selected directory and prompts before cleaning a nonempty directory; dependency installation is conditional on an option.
- The shipped environment file contains blank or substituted credentials and configures Corva service URLs.
- The flagged Python test builds a scheduled event and passes it to the app runner.
- The observed network calls check the package version at npm and configure API requests for Corva.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedcommon/node/.envView file
1patternName = blocked_file
severity = critical
blockedFile = common/node/.env
redactedSecretContext =
secretLikeLines = 2
L1: API_KEY=<redacted:0 empty>
L8: CACHE_URL=<redacted:22 token-like>
Critical
Critical Secret
Package contains a critical-looking secret pattern.
common/node/.envView on unpkg · L1common/python/MakefileView file
•path = common/python/Makefile
kind = build_helper
sizeBytes = 529
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
common/python/MakefileView on unpkgtemplates/scheduler_natural-time/python/test/app_test.pyView file
•path = templates/scheduler_natural-time/python/test/app_test.py
kind = payload_in_excluded_dir
sizeBytes = 281
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/scheduler_natural-time/python/test/app_test.pyView on unpkglib/commands/create.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
lib/commands/create.js#virtual:normalized:round1View on unpkgpackage.jsonView file
17"type": "module",
"bin": {
"create-corva-app": "./bin/create-corva-app.cjs"
},
"files": [
"bin/**/*.cjs",
"bin/**/*.js",
"lib/**/*.js",
"templates",
"template_extensions",
"common"
],
"scripts": {
"build": "echo \"build is not configure
Low
Suspicious Lifecycle Evidence
The manifest exposes a command-line entrypoint and lists development and release scripts, with no package install hook.
package.jsonView on unpkg · L17Findings
1 Critical2 High4 Medium5 Low
CriticalCritical Secretcommon/node/.env
HighPayload In Excluded Dirtemplates/scheduler_natural-time/python/test/app_test.py
HighSemantic Analysis Limitedlib/commands/create.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpercommon/python/Makefile
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @corva/create-app@0.128.1.
See all versions of @corva/create-app for other recorded verdicts.
- Review the evidence and your use of @corva/create-app@0.128.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.