registry / @zuplo/cli / 7.3.0
@zuplo/cli@7.3.0
<p align="center"> <a href="https://zuplo.com"> <img src="https://portal.zuplo.com/zuplo.svg" height="96"> <h3 align="center">Zuplo</h3> </a> </p> <p align="center">Zuplo's API Gateway helps small and large teams get APIs to production that ar
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe flagged primitives are normal, user-invoked CLI functionality with declared endpoints and scoped project migration. Direct inspection found no lifecycle hook or concrete malicious chain.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs zup; file/network changes require zup source migrate dev-portal.
Impact
Expected CLI analytics and requested project-file migration; no install-time or stealth behavior found.
Mechanism
User-invoked CLI telemetry and scoped project migration.
AI rationale
The flagged primitives are normal, user-invoked CLI functionality with declared endpoints and scoped project migration. Direct inspection found no lifecycle hook or concrete malicious chain.
Evidence
package.jsonzup.jsdist/cli.jsdist/common/analytics/lib.jsdist/cmds/source/migrate.jsdist/source/migrate/dev-portal/handler.jsdist/common/api/client.jsdist/login/tokens.jsdocs/package.jsondocs/tsconfig.jsondocs/zudoku.config.tsxconfig/dev-portal.oas.jsonconfig/dev-portal.jsondocs/sidebar.jsondocs/theme.css
Network endpoints2
app.posthog.comcdn.jsdelivr.net/npm/zudoku/package.json
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Runtime CLI telemetry uses PostHog unless ZUPLO_DO_NOT_TRACK is set.
- The explicit dev-portal migration fetches Zudoku metadata and writes project files.
Evidence against
- package.json declares only a zup bin and no lifecycle scripts.
- Mutation is reachable through the explicit source migrate dev-portal command; --force defaults false.
- Migration changes are scoped to the selected project’s docs/config files.
- No source evidence of install-time execution, credential exfiltration, stealth persistence, or AI-agent control-surface writes.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
NoLicense
Source & flagged code
4 flaggeddist/source/migrate/dev-portal/handler.jsView file
650export: "legacyDevPortalHandler",
L651: module: "$import(@zuplo/runtime)",
L652: options: {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/source/migrate/dev-portal/handler.jsView on unpkg · L650491const zudokuPackageJson = await fetch("https://cdn.jsdelivr.net/npm/zudoku/package.json").then((res) => res.json());
const packageJsonContent = {
name: "docs",
version: "1.0.0",
type: "module",
private: true,
scripts: {
dev: "zudoku dev --zuplo",
build: "zudoku build",
start: "zudoku start",
},
dependencies: {
zudoku: zudokuPackageJson.version || "latest",
react: zudokuPackageJson.dependencies.react || "^19.0.0",
Low
Ai Review Evidence
The explicit dev-portal migration fetches Zudoku metadata and writes project files.
dist/source/migrate/dev-portal/handler.jsView on unpkg · L491dist/common/analytics/lib.jsView file
Findings
1 High4 Medium7 Low
HighCopied Package Dependency Bridgedist/common/analytics/lib.js
MediumDynamic Requiredist/source/migrate/dev-portal/handler.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
LowAi Review Evidencedist/common/analytics/lib.js
LowAi Review Evidencedist/source/migrate/dev-portal/handler.js
Affected versions and remediation
This report applies to @zuplo/cli@7.3.0.
See all versions of @zuplo/cli for other recorded verdicts.
- Review the evidence and your use of @zuplo/cli@7.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.