registry / @yagofontanez/create-seo-site / 0.8.0
@yagofontanez/create-seo-site@0.8.0
CLI e biblioteca para sites Next.js focados em SEO/GEO local: gera projetos a partir de um strategy.json e exporta o catálogo de design, o documento de site e os componentes de seção
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged credential flows are tied to documented features: scaffold registration is opt-in, site registration requires an explicit command, and Search Console credentials are used for the configured Search Console API. The package has no install hook or unrelated credential collection in the reviewed paths.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Scaffold registration requires SEO_SITE_TOKEN; the registrar command must be run explicitly; generated Search Console requests require configuration and a feature query.
Impact
These calls provide the intended project registration and Search Console functions; no unrelated credential collection or concealed outbound behavior was identified.
Mechanism
The CLI sends registration data to its configured agency endpoint, while the generated site sends its configured Search Console API key as a bearer token to its configured API endpoint.
AI rationale
The flagged credential flows are tied to documented features: scaffold registration is opt-in, site registration requires an explicit command, and Search Console credentials are used for the configured Search Console API. The package has no install hook or unrelated credential collection in the reviewed paths.
Network endpoints2
btidemhgsmjcnvefzgck.supabase.co/functions/v1/register-scaffoldsearch.pablocabral.com.br/api/search-console/url
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and has only a prepublishOnly build/check script, not an install hook.
- Scaffold registration is documented as opt-in: without SEO_SITE_TOKEN the CLI makes no connection, and the POST contains project design and runtime metadata.
- The separate registrar command is documented as registering a project with the agency panel and tells users it reads SUPABASE_URL and SUPABASE_SECRET_KEY.
- The generated Search Console feature uses SEARCH_CONSOLE_KEY as a bearer token for its configurable Search Console API; its admin page explains how to configure that API.
Evidence against
- When SEO_SITE_TOKEN is configured, init automatically posts scaffold details and that token to the configured registration endpoint.
- The explicitly invoked registrar command sends the selected project's Supabase secret key to the agency panel.
- The generated site's default Search Console API host is a third-party domain, and configured search queries send it the SEARCH_CONSOLE_KEY.
Behavioral surface
ChildProcessCrypto
Source & flagged code
5 flaggedbin/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @yagofontanez/create-seo-site@0.2.0
matchedIdentity = npm:[redacted]:0.2.0
similarity = 1.048
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/cli.jsView on unpkg33Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network
L33: const candidates = [
L34: import_node_path.default.resolve(__dirname, "..", ...segments),
L35: import_node_path.default.resolve(__dirname, "..", "..", ...segments),
...
L269: async function adicionarScripts(targetDir) {
L270: const pkgPath = import_node_path3.default.join(targetDir, "package.json");
L271: if (!import_node_fs3.default.existsSync(pkgPath)) return;
L272: const pkg2 = JSON.parse(await import_promises2.default.readFile(pkgPath, "utf8"));
L273: pkg2.scripts = { ...pkg2.scripts ?? {}, ...SCRIPTS };
...
L293:
L294: var import_node_http = __toESM(require("http"));
L295: var import_node_https = __toESM(require("https"));
.
High
Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
bin/cli.jsView on unpkg · L33Findings
2 Critical3 High3 Medium6 Low
CriticalCredential Exfiltrationtemplates/base-nextjs/src/lib/conversions/meta.ts
CriticalPrevious Version Dangerous Deltabin/cli.js
HighEntrypoint Build Divergencebin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighSemantic Analysis Limiteddist/site.css
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @yagofontanez/create-seo-site@0.8.0.
See all versions of @yagofontanez/create-seo-site for other recorded verdicts.
- Review the evidence and your use of @yagofontanez/create-seo-site@0.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.