registry / @yagofontanez/create-seo-site / 0.10.0
@yagofontanez/create-seo-site@0.10.0
CLI e biblioteca para sites Next.js focados em SEO/GEO local: gera projetos a partir de um strategy.json e exporta o catálogo de design, o documento de site e os componentes de seção
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe credential-bearing registration is disclosed and runs only through an explicit command, while scaffold reporting requires a token. The inspected template network calls target the corresponding analytics services, and the package has no install hook.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Scaffold reporting requires an explicitly configured token; Supabase registration requires running the registrar command; generated analytics run when configured and used by a site.
Impact
These actions support the documented agency panel and conversion reporting features; no undisclosed credential collection or unrelated transmission was identified.
Mechanism
The CLI posts scaffold metadata or explicitly supplied project registration details to the agency endpoint. Generated conversion code sends configured events to Meta.
AI rationale
The credential-bearing registration is disclosed and runs only through an explicit command, while scaffold reporting requires a token. The inspected template network calls target the corresponding analytics services, and the package has no install hook.
Network endpoints3
btidemhgsmjcnvefzgck.supabase.cograph.facebook.comsearch.pablocabral.com.br
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes the CLI separately from the library entry points and has no install hook; its prepublishOnly script runs build checks.
- Scaffold registration is documented as opt-in and sends nothing unless SEO_SITE_TOKEN is set.
- The documented registrar command reads Supabase credentials so the agency panel can read leads; it sends them only when that command is run.
- The generated Meta conversion integration posts configured conversion events to Meta's Graph API.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
5 flaggedbin/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @yagofontanez/create-seo-site@0.2.0
matchedIdentity = npm:[redacted]:0.2.0
similarity = 1.048
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/cli.jsView on unpkg33Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network
L33: const candidates = [
L34: import_node_path.default.resolve(__dirname, "..", ...segments),
L35: import_node_path.default.resolve(__dirname, "..", "..", ...segments),
...
L269: async function adicionarScripts(targetDir) {
L270: const pkgPath = import_node_path3.default.join(targetDir, "package.json");
L271: if (!import_node_fs3.default.existsSync(pkgPath)) return;
L272: const pkg2 = JSON.parse(await import_promises2.default.readFile(pkgPath, "utf8"));
L273: pkg2.scripts = { ...pkg2.scripts ?? {}, ...SCRIPTS };
...
L293:
L294: var import_node_http = __toESM(require("http"));
L295: var import_node_https = __toESM(require("https"));
.
High
Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
bin/cli.jsView on unpkg · L33Findings
2 Critical3 High3 Medium6 Low
CriticalCredential Exfiltrationtemplates/base-nextjs/src/lib/conversions/meta.ts
CriticalPrevious Version Dangerous Deltabin/cli.js
HighEntrypoint Build Divergencebin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighSemantic Analysis Limiteddist/site.css
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @yagofontanez/create-seo-site@0.10.0.
See all versions of @yagofontanez/create-seo-site for other recorded verdicts.
- Review the evidence and your use of @yagofontanez/create-seo-site@0.10.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.