registry / @yagofontanez/create-seo-site / 0.13.0
@yagofontanez/create-seo-site@0.13.0
CLI e biblioteca para sites Next.js focados em SEO/GEO local: gera projetos a partir de um strategy.json e exporta o catálogo de design, o documento de site e os componentes de seção
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged credential flows are tied to disclosed registration or generated site integrations and send credentials to the corresponding configured service. No unrelated collection, concealed execution, or unrequested account action was identified.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Project registration runs during project creation only when SEO_SITE_TOKEN is set; the separate registrar command runs when explicitly invoked. Template integrations run when their generated application uses them and their service credentials are configured.
Impact
The reviewed flows disclose and use their intended service credentials and data for dashboard registration, conversion tracking, and search analytics.
Mechanism
Registration sends project design metadata and runtime versions to the configured endpoint. The registrar command uses the agency token and Supabase settings; generated integrations send conversion events to Meta and query the configured Search Console API.
AI rationale
The flagged credential flows are tied to disclosed registration or generated site integrations and send credentials to the corresponding configured service. No unrelated collection, concealed execution, or unrequested account action was identified.
Network endpoints3
btidemhgsmjcnvefzgck.supabase.co/functions/v1/register-scaffoldgraph.facebook.comsearch.pablocabral.com.br
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exports its JavaScript library from dist; the flagged CLI is a separately declared executable.
- Scaffold registration requires SEO_SITE_TOKEN and sends project design choices plus CLI, Node, and platform versions to the configured registration endpoint.
- The scaffold-registration call is part of the explicit project creation flow; no unrelated credential or file content is included in its payload.
- The separate registrar command describes its use of Supabase credentials and requires the agency token, making registration opt-in.
- The generated Meta integration posts conversion events to Meta's Graph API when configured with a Meta pixel and token.
- The generated Search Console integration sends its configured bearer key to its configured Search Console API.
Evidence against
- The CLI contains network and credential-handling code, including a default Supabase endpoint and a separate registration command that reads Supabase credentials.
- The generated template includes analytics and Search Console integrations that transmit user or site data when configured.
Behavioral surface
Source & flagged code
5 flaggedbin/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @yagofontanez/create-seo-site@0.2.0
matchedIdentity = npm:[redacted]:0.2.0
similarity = 1.048
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/cli.jsView on unpkg33Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network
L33: const candidates = [
L34: import_node_path.default.resolve(__dirname, "..", ...segments),
L35: import_node_path.default.resolve(__dirname, "..", "..", ...segments),
...
L269: async function adicionarScripts(targetDir) {
L270: const pkgPath = import_node_path3.default.join(targetDir, "package.json");
L271: if (!import_node_fs3.default.existsSync(pkgPath)) return;
L272: const pkg2 = JSON.parse(await import_promises2.default.readFile(pkgPath, "utf8"));
L273: pkg2.scripts = { ...pkg2.scripts ?? {}, ...SCRIPTS };
...
L293:
L294: var import_node_http = __toESM(require("http"));
L295: var import_node_https = __toESM(require("https"));
.
High
Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
bin/cli.jsView on unpkg · L33Findings
2 Critical3 High3 Medium6 Low
CriticalCredential Exfiltrationtemplates/base-nextjs/src/lib/conversions/meta.ts
CriticalPrevious Version Dangerous Deltabin/cli.js
HighEntrypoint Build Divergencebin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighSemantic Analysis Limiteddist/site.css
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @yagofontanez/create-seo-site@0.13.0.
See all versions of @yagofontanez/create-seo-site for other recorded verdicts.
- Review the evidence and your use of @yagofontanez/create-seo-site@0.13.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.