registry / @yagofontanez/create-seo-site / 0.10.1
@yagofontanez/create-seo-site@0.10.1
CLI e biblioteca para sites Next.js focados em SEO/GEO local: gera projetos a partir de um strategy.json e exporta o catálogo de design, o documento de site e os componentes de seção
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe credential and network flows inspected are tied to documented, purpose-specific features: optional agency registration and generated Meta and Search Console integrations. Registration is token-gated, and sending site credentials to the agency dashboard requires the explicit registrar command.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Scaffold registration requires SEO_SITE_TOKEN; site registration runs only through the explicit registrar command; generated integrations run when the site uses them with their configuration present.
Impact
No unauthorized collection or action was identified in the inspected flows.
Mechanism
The CLI sends scaffold metadata to its configured agency endpoint, and the registrar sends site Supabase credentials to the agency dashboard. Generated templates send configured conversion data to Meta and Search Console requests to their configured API service.
AI rationale
The credential and network flows inspected are tied to documented, purpose-specific features: optional agency registration and generated Meta and Search Console integrations. Registration is token-gated, and sending site credentials to the agency dashboard requires the explicit registrar command.
Evidence
bin/cli.jsREADME.mdtemplates/base-nextjs/src/lib/conversions/meta.tstemplates/base-nextjs/src/lib/search-console.ts
Network endpoints3
btidemhgsmjcnvefzgck.supabase.cograph.facebook.comsearch.pablocabral.com.br
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI separately from the library entry points.
- Scaffold registration is documented as opt-in and sends nothing without SEO_SITE_TOKEN.
- The scaffold callback requires that token and sends project and template metadata.
- The separate registrar command is described as registering a configured site with the agency dashboard; it reads the site’s Supabase credentials for that purpose.
- The generated Meta integration sends configured conversion events to Meta’s Graph API.
- The generated Search Console integration requires SEARCH_CONSOLE_KEY and supports a configurable API URL.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
5 flaggedbin/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @yagofontanez/create-seo-site@0.2.0
matchedIdentity = npm:[redacted]:0.2.0
similarity = 1.048
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/cli.jsView on unpkg33Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network
L33: const candidates = [
L34: import_node_path.default.resolve(__dirname, "..", ...segments),
L35: import_node_path.default.resolve(__dirname, "..", "..", ...segments),
...
L269: async function adicionarScripts(targetDir) {
L270: const pkgPath = import_node_path3.default.join(targetDir, "package.json");
L271: if (!import_node_fs3.default.existsSync(pkgPath)) return;
L272: const pkg2 = JSON.parse(await import_promises2.default.readFile(pkgPath, "utf8"));
L273: pkg2.scripts = { ...pkg2.scripts ?? {}, ...SCRIPTS };
...
L293:
L294: var import_node_http = __toESM(require("http"));
L295: var import_node_https = __toESM(require("https"));
.
High
Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
bin/cli.jsView on unpkg · L33Findings
2 Critical3 High3 Medium6 Low
CriticalCredential Exfiltrationtemplates/base-nextjs/src/lib/conversions/meta.ts
CriticalPrevious Version Dangerous Deltabin/cli.js
HighEntrypoint Build Divergencebin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighSemantic Analysis Limiteddist/site.css
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @yagofontanez/create-seo-site@0.10.1.
See all versions of @yagofontanez/create-seo-site for other recorded verdicts.
- Review the evidence and your use of @yagofontanez/create-seo-site@0.10.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.