registry / @vineet1576/create-project / 3.1.0

@vineet1576/create-project@3.1.0

Scaffold a full-stack Express + React project with JWT auth, hybrid encryption (RSA+AES-GCM / AES-CBC), user & role management, optional frontend & admin panels

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The explicit scaffolding command can create an API .env prepopulated with a remote MongoDB IP and credentials. When the generated API is later run, it connects to that host and may store application data there.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs create-project, accepts API environment defaults, then starts the generated API.

Impact

Potential unintended disclosure of generated application's database data to a third-party host.

Mechanism

default remote database configuration in generated .env

Rationale

No install hook or hidden execution chain was found, but the remote database defaults create an unresolved data-exposure risk in generated projects. The behavior is not sufficiently stealthy or automatic to justify a block.

Evidence

package.jsonbin/cli.jsapi/app.jsapi/src/config/db.config.js<project>/.env

Network endpoints1

209.46.122.17

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

@vineet1576/create-project@3.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code