registry / @yagofontanez/create-seo-site / 0.9.0
@yagofontanez/create-seo-site@0.9.0
CLI e biblioteca para sites Next.js focados em SEO/GEO local: gera projetos a partir de um strategy.json e exporta o catálogo de design, o documento de site e os componentes de seção
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe credential flows are tied to the package's documented agency registration and generated SEO integrations. Scaffold reporting is opt-in, site registration requires an explicit command, and no install or import-time attack behavior was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The CLI runs when a user invokes a command. Scaffold registration additionally requires SEO_SITE_TOKEN; site registration requires the explicit registrar command.
Impact
These network actions serve documented, user-invoked features; no automatic install-time or import-time exfiltration was identified.
Mechanism
Optional scaffold registration posts limited project metadata to the agency endpoint. The registrar command sends the configured Supabase URL and secret key to the agency panel, as documented. Generated integrations send configured data and credentials to their corresponding services.
AI rationale
The credential flows are tied to the package's documented agency registration and generated SEO integrations. Scaffold reporting is opt-in, site registration requires an explicit command, and no install or import-time attack behavior was found.
Evidence
package.jsonbin/cli.jsREADME.mdtemplates/base-nextjs/src/lib/conversions/meta.tstemplates/base-nextjs/src/lib/search-console.ts
Network endpoints3
btidemhgsmjcnvefzgck.supabase.co/functions/v1/register-scaffoldgraph.facebook.com/{v21.0}/{PIXEL_ID}/eventssearch.pablocabral.com.br/api/search-console/url (configurable via SEARCH_CONSOLE_API_URL)
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only lifecycle script is prepublishOnly, which runs checks and builds; no install hook is declared.
- Scaffold registration is documented as opt-in and sends project name, design choices, CLI version, and platform only when SEO_SITE_TOKEN is set.
- The registrar command requires the token and is explicitly described as sending the project's Supabase credentials to the agency panel so it can read leads.
- The generated Meta integration sends conversion events to Meta's Graph API; the Search Console integration sends its configured key to its configured API.
- The library entry points are separate from the CLI executable.
Evidence against
- The explicit registrar command sends SUPABASE_SECRET_KEY and project details to the agency panel, but the README describes this behavior and its purpose.
- The CLI has an optional network registration path, but its documented token gate prevents it from running by default.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
Source & flagged code
5 flaggedbin/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @yagofontanez/create-seo-site@0.2.0
matchedIdentity = npm:[redacted]:0.2.0
similarity = 1.048
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/cli.jsView on unpkg33Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network
L33: const candidates = [
L34: import_node_path.default.resolve(__dirname, "..", ...segments),
L35: import_node_path.default.resolve(__dirname, "..", "..", ...segments),
...
L269: async function adicionarScripts(targetDir) {
L270: const pkgPath = import_node_path3.default.join(targetDir, "package.json");
L271: if (!import_node_fs3.default.existsSync(pkgPath)) return;
L272: const pkg2 = JSON.parse(await import_promises2.default.readFile(pkgPath, "utf8"));
L273: pkg2.scripts = { ...pkg2.scripts ?? {}, ...SCRIPTS };
...
L293:
L294: var import_node_http = __toESM(require("http"));
L295: var import_node_https = __toESM(require("https"));
.
High
Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
bin/cli.jsView on unpkg · L33Findings
2 Critical3 High3 Medium6 Low
CriticalCredential Exfiltrationtemplates/base-nextjs/src/lib/conversions/meta.ts
CriticalPrevious Version Dangerous Deltabin/cli.js
HighEntrypoint Build Divergencebin/cli.js
HighSandbox Evasion Gated Capabilitybin/cli.js
HighSemantic Analysis Limiteddist/site.css
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @yagofontanez/create-seo-site@0.9.0.
See all versions of @yagofontanez/create-seo-site for other recorded verdicts.
- Review the evidence and your use of @yagofontanez/create-seo-site@0.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.