registry / @corva/create-app / 0.128.2
@corva/create-app@0.128.2
⚠ Under reviewCreate an app to use it in CORVA.AI
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe inspected first-party behavior is consistent with a CLI that creates apps, checks its version, and uploads releases to Corva. Source for imported registry dependencies including got and cross-spawn was not available in the inspected snapshot, so their runtime behavior remains unresolved.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user invokes the CLI; release and template dependency installation are user-requested operations.
Impact
No unauthorized credential transfer or other attack effect was established; the incomplete dependency review prevents a clean determination.
Mechanism
The release flow uses the API client to upload a package, and the launcher uses a process-spawn dependency. The missing dependency implementations prevent fully resolving those paths.
AI rationale
The inspected first-party behavior is consistent with a CLI that creates apps, checks its version, and uploads releases to Corva. Source for imported registry dependencies including got and cross-spawn was not available in the inspected snapshot, so their runtime behavior remains unresolved.
Evidence
package.jsonlib/flows/lib/api.jsbin/create-corva-app.cjs
Network endpoints2
api.corva.airegistry.npmjs.org/@corva/create-app/latest
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest exposes a CLI and lists development scripts; its launcher invokes Node with shell execution disabled.
- Inspected dependency sources show archive construction, terminal styling, and command parser exports; their manifests list test or benchmark scripts.
- The flagged environment file has a blank API key and Corva endpoint placeholders; the flagged Python test constructs a sample event and invokes its handler.
- The release flow uploads a zip through the Corva API package endpoint using the API client. The version check fetches package metadata from the npm registry.
- The package declares and imports got and cross-spawn, but their implementation source is absent from the inspected dependency snapshot.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedcommon/node/.envView file
1patternName = blocked_file
severity = critical
blockedFile = common/node/.env
redactedSecretContext =
secretLikeLines = 2
L1: API_KEY=<redacted:0 empty>
L8: CACHE_URL=<redacted:22 token-like>
Critical
Critical Secret
Package contains a critical-looking secret pattern.
common/node/.envView on unpkg · L1common/python/MakefileView file
•path = common/python/Makefile
kind = build_helper
sizeBytes = 529
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
common/python/MakefileView on unpkgtemplates/scheduler_natural-time/python/test/app_test.pyView file
Findings
1 Critical3 High4 Medium4 Low
CriticalCritical Secretcommon/node/.env
HighPayload In Excluded Dirtemplates/scheduler_natural-time/python/test/app_test.py
HighSemantic Analysis Limitedlib/commands/create.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltalib/flows/steps/release/upload-zip-to-corva.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpercommon/python/Makefile
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @corva/create-app@0.128.2.
See all versions of @corva/create-app for other recorded verdicts.
- Review the evidence and your use of @corva/create-app@0.128.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.