@vineet1576/create-project@3.0.0

No blocking static signals were detected.; previous stored version diff introduced dangerous source

User runs create-project, accepts default .env values, then starts the generated backend.

Generated application data and user records can be transmitted to an undisclosed external database.

Hardcoded remote database defaults in generated configuration

The CLI defaults to creating a .env file and supplies a fixed public database host and credentials. It writes these values into the generated project; its backend then automatically connects using the resulting MongoDB URL when started. This routes generated application data to an external server unless the user notices and replaces the defaults.

The undisclosed, hardcoded public database destination and credentials create a concrete default data-exfiltration path in generated projects. The absence of a lifecycle hook does not mitigate the user-invoked scaffold's unsafe default behavior.