registry / @yagofontanez/create-seo-site
@yagofontanez/create-seo-site
CLI e biblioteca para sites Next.js focados em SEO/GEO local: gera projetos a partir de um strategy.json e exporta o catálogo de design, o documento de site e os componentes de seção
This report shows the evidence for @yagofontanez/create-seo-site@0.14.1. 0 of 13 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe credential flows are tied to disclosed product features: optional agency registration and Meta conversion tracking. No install-time exfiltration, hidden default credential transfer, or unrelated attack behavior was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Scaffold registration requires SEO_SITE_TOKEN; transferring site credentials requires running the registrar command.
Impact
The reviewed behavior registers opted-in scaffolds and configured sites, and forwards conversion events to Meta; no unrelated credential collection or concealed transfer was identified.
Mechanism
The CLI posts documented scaffold metadata to the agency endpoint when opted in. The registrar sends Supabase credentials for the agency panel, and the generated conversion code sends Meta events to Meta’s Graph API.
AI rationale
The credential flows are tied to disclosed product features: optional agency registration and Meta conversion tracking. No install-time exfiltration, hidden default credential transfer, or unrelated attack behavior was found.
Network endpoints2
btidemhgsmjcnvefzgck.supabase.co/functions/v1/register-scaffoldgraph.facebook.com/{version}/{pixel_id}/events
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The declared prepublishOnly script runs contrast checks and a build; the manifest declares no install hook.
- Scaffold registration returns without a request unless SEO_SITE_TOKEN is set, and its endpoint can be overridden by SEO_SITE_API_URL.
- The README labels scaffold registration opt-in, documents the fields sent, and says no connection occurs without the token.
- The registrar command is separately invoked and described as reading Supabase credentials to register a configured site in the agency panel.
- The generated conversion module sends META_CAPI_TOKEN to Meta’s Graph API when Meta conversion tracking is configured.
Evidence against
- The registrar sends SUPABASE_URL and SUPABASE_SECRET_KEY to the agency’s Supabase endpoint, but only through the documented registrar command.
- Scaffold creation can send project metadata when SEO_SITE_TOKEN is configured; the README documents this behavior and its payload.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
Source & flagged code
5 flaggedbin/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @yagofontanez/create-seo-site@0.2.0
matchedIdentity = npm:[redacted]:0.2.0
similarity = 1.048
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/cli.jsView on unpkg33Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network
L33: const candidates = [
L34: import_node_path.default.resolve(__dirname, "..", ...segments),
L35: import_node_path.default.resolve(__dirname, "..", "..", ...segments),
...
L269: async function adicionarScripts(targetDir) {
L270: const pkgPath = import_node_path3.default.join(targetDir, "package.json");
L271: if (!import_node_fs3.default.existsSync(pkgPath)) return;
L272: const pkg2 = JSON.parse(await import_promises2.default.readFile(pkgPath, "utf8"));
L273: pkg2.scripts = { ...pkg2.scripts ?? {}, ...SCRIPTS };
...
L293:
L294: var import_node_http = __toESM(require("http"));
L295: var import_node_https = __toESM(require("https"));
.
High
Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
bin/cli.jsView on unpkg · L33Findings
2 Critical3 High3 Medium6 Low
CriticalCredential Exfiltrationtemplates/base-nextjs/src/lib/conversions/meta.ts
CriticalPrevious Version Dangerous Deltabin/cli.js
HighEntrypoint Build Divergencebin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighSemantic Analysis Limiteddist/site.css
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @yagofontanez/create-seo-site@0.14.1.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @yagofontanez/create-seo-site@0.14.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.