registry / @yagofontanez/create-seo-site / 0.12.0
@yagofontanez/create-seo-site@0.12.0
CLI e biblioteca para sites Next.js focados em SEO/GEO local: gera projetos a partir de um strategy.json e exporta o catálogo de design, o documento de site e os componentes de seção
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe CLI’s scaffold registration is documented as opt-in and sends limited scaffold metadata only when its agency token is configured. The separate registrar command explicitly registers a project using its Supabase credentials, while generated-site API calls use service-specific credentials for their documented services.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The CLI sends scaffold metadata only when SEO_SITE_TOKEN is set; project credential registration and generated-site API calls require user configuration or invocation.
Impact
No malicious impact was identified in the reviewed flows.
Mechanism
The reviewed requests serve documented scaffold registration, agency-panel, Search Console, and Meta conversion functions.
AI rationale
The CLI’s scaffold registration is documented as opt-in and sends limited scaffold metadata only when its agency token is configured. The separate registrar command explicitly registers a project using its Supabase credentials, while generated-site API calls use service-specific credentials for their documented services.
Network endpoints5
btidemhgsmjcnvefzgck.supabase.cosearch.pablocabral.com.brgraph.facebook.comfonts.googleapis.comfonts.gstatic.com
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The CLI’s scaffold registration request is gated by SEO_SITE_TOKEN and sends project design metadata plus package/runtime details.
- The README documents scaffold registration as opt-in and states that nothing is sent without the token.
- The registrar command requires SEO_SITE_TOKEN and runs only when the user invokes that subcommand.
- The README explains that registrar reads the client’s Supabase credentials so the agency panel can display leads.
- The generated Search Console module uses a configured API base and sends its key as a bearer token to that API.
- The generated Meta conversion module sends its Meta CAPI token and conversion event to Meta’s Graph API.
Evidence against
- The package has no install, preinstall, or postinstall hook; its prepublishOnly script is a build/check script.
- The flagged credential flows are gated by explicit configuration or commands and match the documented package or service purpose.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
Source & flagged code
5 flaggedbin/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @yagofontanez/create-seo-site@0.2.0
matchedIdentity = npm:[redacted]:0.2.0
similarity = 1.048
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/cli.jsView on unpkg33Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network
L33: const candidates = [
L34: import_node_path.default.resolve(__dirname, "..", ...segments),
L35: import_node_path.default.resolve(__dirname, "..", "..", ...segments),
...
L269: async function adicionarScripts(targetDir) {
L270: const pkgPath = import_node_path3.default.join(targetDir, "package.json");
L271: if (!import_node_fs3.default.existsSync(pkgPath)) return;
L272: const pkg2 = JSON.parse(await import_promises2.default.readFile(pkgPath, "utf8"));
L273: pkg2.scripts = { ...pkg2.scripts ?? {}, ...SCRIPTS };
...
L293:
L294: var import_node_http = __toESM(require("http"));
L295: var import_node_https = __toESM(require("https"));
.
High
Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
bin/cli.jsView on unpkg · L33Findings
2 Critical3 High3 Medium6 Low
CriticalCredential Exfiltrationtemplates/base-nextjs/src/lib/conversions/meta.ts
CriticalPrevious Version Dangerous Deltabin/cli.js
HighEntrypoint Build Divergencebin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighSemantic Analysis Limiteddist/site.css
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @yagofontanez/create-seo-site@0.12.0.
See all versions of @yagofontanez/create-seo-site for other recorded verdicts.
- Review the evidence and your use of @yagofontanez/create-seo-site@0.12.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.