registry / betterstart-cli / 0.0.24

betterstart-cli@0.0.24

Scaffold a plugin-based Admin into any Next.js 16 application

AI Security Review

scanned 17d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The risky primitives are expected for a Next.js admin scaffolding CLI and are activated by explicit CLI commands.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs the betterstart CLI commands such as init, add, generate, update, seed, remove, or uninstall.

Impact

Creates, updates, or removes BetterStart-managed project files and can run local package-manager/dev tooling when the user invokes those workflows.

Mechanism

Project scaffolding, dependency installation, config loading, and optional integration provisioning.

Rationale

Static inspection shows a legitimate scaffolding/codegen CLI with broad but user-invoked project mutation and network-capable integration templates. I found no install-time execution, credential exfiltration, hidden remote payload, or unconsented control-surface mutation.

Evidence

package.jsondist/index.jsdist/cli.jsdist/chunk-M4S53A4X.jsdist/template-reader-X6KFP7B3.jsdist/assets/adapters/next/templates/init/utils/webhook/webhook.tsdist/assets/adapters/next/templates/init/lib/actions/forms/test-form-webhook.tsdist/assets/adapters/next/templates/init/lib/actions/upload/upload-media-from-url.tsadmin.config.ts.env.local.betterstart/**admin/**

betterstart-cli@0.0.24

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code