registry / @yagofontanez/create-seo-site / 0.4.0
@yagofontanez/create-seo-site@0.4.0
⚠ Under reviewCLI para gerar projetos Next.js focados em SEO/GEO local a partir de um strategy.json
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
2 flaggedtemplates/base-nextjs/src/lib/conversions/meta.tsView file
6L7: const PIXEL_ID = process.env.NEXT_PUBLIC_META_PIXEL_ID;
L8:
...
L34: action_source: "website",
L35: user_data: limpar({
L36: ...userDataDaIdentidade(conversao.identidade),
...
L49: try {
L50: const resposta = await fetch(
L51: `https://graph.facebook.com/${VERSAO_API}/${PIXEL_ID}/events`,
...
L65: if (!resposta.ok) {
L66: console.error("[capi] meta recusou:", resposta.status, await resposta.text());
L67: return "erro";
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
templates/base-nextjs/src/lib/conversions/meta.tsView on unpkg · L6bin/cli.jsView file
33const candidates = [
L34: import_node_path.default.resolve(__dirname, "..", ...segments),
L35: import_node_path.default.resolve(__dirname, "..", "..", ...segments),
...
L175:
L176: var import_node_http = __toESM(require("http"));
L177: var import_node_https = __toESM(require("https"));
...
L180: function urlDoRegistro() {
L181: return process.env.SEO_SITE_API_URL ?? REGISTRO_API_URL;
L182: }
...
L194: try {
L195: const pkg2 = JSON.parse(
L196: import_node_fs3.default.readFileSync(packagePath("package.json"), "utf8")
Findings
1 Critical1 High3 Medium6 Low
CriticalCredential Exfiltrationtemplates/base-nextjs/src/lib/conversions/meta.ts
HighSandbox Evasion Gated Capabilitybin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @yagofontanez/create-seo-site@0.4.0.
See all versions of @yagofontanez/create-seo-site for other recorded verdicts.
- Review the evidence and your use of @yagofontanez/create-seo-site@0.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.