registry / @yagofontanez/create-seo-site / 0.11.1
@yagofontanez/create-seo-site@0.11.1
CLI e biblioteca para sites Next.js focados em SEO/GEO local: gera projetos a partir de um strategy.json e exporta o catálogo de design, o documento de site e os componentes de seção
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package has no install-time hook or import-time collection identified. Credential-bearing requests are gated by configuration or an explicit registration command, and their destinations and purposes match the package's documented integrations.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Scaffold reporting requires SEO_SITE_TOKEN; credential registration requires the user to run `seo-site registrar`. Generated integrations run when the generated site uses them and has their configuration set.
Impact
No malicious impact identified. The registrar's credential transfer is sensitive but is disclosed and tied to an explicit user command.
Mechanism
The CLI reports scaffold metadata to its configured agency endpoint, and the explicit registrar sends configured Supabase credentials there. Generated templates send conversion events to Meta and Search Console requests to the configured API.
AI rationale
The package has no install-time hook or import-time collection identified. Credential-bearing requests are gated by configuration or an explicit registration command, and their destinations and purposes match the package's documented integrations.
Evidence
bin/cli.jstemplates/base-nextjs/src/lib/conversions/meta.tstemplates/base-nextjs/src/lib/search-console.ts
Network endpoints3
btidemhgsmjcnvefzgck.supabase.cograph.facebook.comsearch.pablocabral.com.br
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and its prepublishOnly script runs build checks; it declares no install-time hook.
- Scaffold reporting returns without SEO_SITE_TOKEN, sends limited project and design metadata, and is documented as opt-in.
- The registrar command explicitly requires SEO_SITE_TOKEN; its CLI description and README disclose that it sends the site's Supabase credentials to the agency panel when run.
- The generated Meta conversion integration sends configured conversion events and its token to Meta's Graph API.
- The generated Search Console integration sends SEARCH_CONSOLE_KEY as a bearer token to its configured API, with a documented-in-code default endpoint.
Evidence against
- The explicit registrar command transmits SUPABASE_SECRET_KEY to the agency panel; this is a sensitive credential transfer, though the command and README disclose it and require an explicit invocation.
- The generated Search Console template uses a package-associated default API endpoint for a configured key; the endpoint is overridable through SEARCH_CONSOLE_API_URL.
Behavioral surface
Source & flagged code
5 flaggedbin/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @yagofontanez/create-seo-site@0.2.0
matchedIdentity = npm:[redacted]:0.2.0
similarity = 1.048
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/cli.jsView on unpkg33Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network
L33: const candidates = [
L34: import_node_path.default.resolve(__dirname, "..", ...segments),
L35: import_node_path.default.resolve(__dirname, "..", "..", ...segments),
...
L269: async function adicionarScripts(targetDir) {
L270: const pkgPath = import_node_path3.default.join(targetDir, "package.json");
L271: if (!import_node_fs3.default.existsSync(pkgPath)) return;
L272: const pkg2 = JSON.parse(await import_promises2.default.readFile(pkgPath, "utf8"));
L273: pkg2.scripts = { ...pkg2.scripts ?? {}, ...SCRIPTS };
...
L293:
L294: var import_node_http = __toESM(require("http"));
L295: var import_node_https = __toESM(require("https"));
.
High
Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
bin/cli.jsView on unpkg · L33Findings
2 Critical3 High3 Medium6 Low
CriticalCredential Exfiltrationtemplates/base-nextjs/src/lib/conversions/meta.ts
CriticalPrevious Version Dangerous Deltabin/cli.js
HighEntrypoint Build Divergencebin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighSemantic Analysis Limiteddist/site.css
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @yagofontanez/create-seo-site@0.11.1.
See all versions of @yagofontanez/create-seo-site for other recorded verdicts.
- Review the evidence and your use of @yagofontanez/create-seo-site@0.11.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.