registry / @zuplo/cli / 7.6.0

@zuplo/cli@7.6.0

<p align="center"> <a href="https://zuplo.com"> <img src="https://portal.zuplo.com/zuplo.svg" height="96"> <h3 align="center">Zuplo</h3> </a> </p> <p align="center">Zuplo's API Gateway helps small and large teams get APIs to production that ar

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package is a normal user-invoked Zuplo CLI with no lifecycle hook or runtime self-dependency. Its network and project-file operations are attributable to telemetry and an explicit migration command, not a covert install-time chain.

Static reason

One or more suspicious static signals were detected.

Trigger

Running the CLI, or explicitly running source migrate dev-portal.

Impact

Telemetry may send command metadata; the migration can modify the selected project directory.

Mechanism

CLI telemetry and explicit project migration.

AI rationale

Evidence

package.jsondist/cli.jsdist/common/analytics/lib.jsdist/cmds/source/migrate.jsdist/source/migrate/dev-portal/handler.jsdocs/package.jsondocs/tsconfig.jsondocs/pagesconfig/dev-portal.oas.jsonconfig/dev-portal.jsondocs/sidebar.jsondocs/theme.css

Network endpoints3

app.posthog.comcdn.jsdelivr.net/npm/zudoku/package.jsoncdn.jsdelivr.net/npm/create-zudoku/dist/templates/zuplo/tsconfig.json

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The CLI sends command telemetry to PostHog unless the user sets its opt-out environment variable.
An explicit dev-portal migration downloads Zudoku metadata and a template, then writes project documentation files.

Evidence against

package.json has a bin entry but no preinstall, install, postinstall, or self-dependency.
The migration is reachable only through the named "source migrate dev-portal" command and documents a force option.
Telemetry records command and version metadata; no credential or environment harvesting was found in the inspected telemetry path.
The child-process use only checks Git status before the user-invoked migration.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Source & flagged code

3 flagged

dist/source/migrate/dev-portal/handler.jsView file

650export: "legacyDevPortalHandler", L651: module: "$import(@zuplo/runtime)", L652: options: {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/source/migrate/dev-portal/handler.jsView on unpkg · L650

491const zudokuPackageJson = await fetch("https://cdn.jsdelivr.net/npm/zudoku/package.json").then((res) => res.json()); const packageJsonContent = { name: "docs", version: "1.0.0", type: "module", private: true, scripts: { dev: "zudoku dev --zuplo", build: "zudoku build", start: "zudoku start", }, dependencies: { zudoku: zudokuPackageJson.version || "latest", react: zudokuPackageJson.dependencies.react || "^19.0.0",

Low

Ai Review Evidence

An explicit dev-portal migration downloads Zudoku metadata and a template, then writes project documentation files.

dist/source/migrate/dev-portal/handler.jsView on unpkg · L491

dist/common/analytics/lib.jsView file

Findings

1 High4 Medium6 Low

HighCopied Package Dependency Bridgedist/common/analytics/lib.js

MediumDynamic Requiredist/source/migrate/dev-portal/handler.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

LowAi Review Evidencedist/source/migrate/dev-portal/handler.js

Affected versions and remediation

This report applies to @zuplo/cli@7.6.0.

See all versions of @zuplo/cli for other recorded verdicts.

Review the evidence and your use of @zuplo/cli@7.6.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-28 14:25:56.510Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @zuplo/cli / 7.6.0

@zuplo/cli@7.6.0

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.

Trigger

Running the CLI, or explicitly running source migrate dev-portal.

Impact

Telemetry may send command metadata; the migration can modify the selected project directory.

Mechanism

CLI telemetry and explicit project migration.

AI rationale

Evidence

Network endpoints3

app.posthog.comcdn.jsdelivr.net/npm/zudoku/package.jsoncdn.jsdelivr.net/npm/create-zudoku/dist/templates/zuplo/tsconfig.json

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The CLI sends command telemetry to PostHog unless the user sets its opt-out environment variable.
An explicit dev-portal migration downloads Zudoku metadata and a template, then writes project documentation files.

Evidence against

package.json has a bin entry but no preinstall, install, postinstall, or self-dependency.
The migration is reachable only through the named "source migrate dev-portal" command and documents a force option.
Telemetry records command and version metadata; no credential or environment harvesting was found in the inspected telemetry path.
The child-process use only checks Git status before the user-invoked migration.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Source & flagged code

3 flagged

dist/source/migrate/dev-portal/handler.jsView file

650export: "legacyDevPortalHandler", L651: module: "$import(@zuplo/runtime)", L652: options: {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/source/migrate/dev-portal/handler.jsView on unpkg · L650

Low

Ai Review Evidence

An explicit dev-portal migration downloads Zudoku metadata and a template, then writes project documentation files.

dist/source/migrate/dev-portal/handler.jsView on unpkg · L491

dist/common/analytics/lib.jsView file

Findings

1 High4 Medium6 Low

HighCopied Package Dependency Bridgedist/common/analytics/lib.js

MediumDynamic Requiredist/source/migrate/dev-portal/handler.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

LowAi Review Evidencedist/source/migrate/dev-portal/handler.js

Affected versions and remediation

This report applies to @zuplo/cli@7.6.0.

See all versions of @zuplo/cli for other recorded verdicts.

Review the evidence and your use of @zuplo/cli@7.6.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-28 14:25:56.510Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.