Loading npm security reports…

create-apollo-monorepo@0.9.347: Suspicious npm security report | LPM Firewall

registry / create-apollo-monorepo / 0.9.347

create-apollo-monorepo@0.9.347

Scaffold a monorepo with a frontend app and Apollo CMS as a git submodule backend (single-origin via Next.js rewrites + assetPrefix)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 87.0 KB of source, external domains: 127.0.0.1, backend.internal, bun.sh, cms.example.com, git-scm.com, github.com, nodejs.org, openapi.vercel.sh, yourdomain.com

Source & flagged code

3 flagged

index.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

3// create-apollo-monorepo — Zero-dependency scaffolder for an Apollo CMS monorepo

4// Usage: npx create-apollo-monorepo <directory> [flags]

5//

6// Produces:

7// <directory>/

8// ├── apps/

9// │ ├── frontend/ ← your app (pnpm workspace member)

10// │ └── backend/ ← git submodule → apollo-cms

11// ├── package.json

12// ├── pnpm-workspace.yaml

13// ├── .env.local

14// ├── .gitmodules

15// └── .gitignore

17import { execSync } from "node:child_process";

18import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

index.mjsView on unpkg · L16

19import { existsSync, mkdirSync, writeFileSync, symlinkSync, rmSync } from "node:fs";

20import { resolve, basename } from "node:path";

21import { createInterface } from "node:readline";

23// ─── Constants ───────────────────────────────────────────────────────────────

25const BACKEND_REPO_URL = "https://github.com/5Lab-Group-Co-Ltd/apollo-cms.git";

26const BACKEND_BRANCH = "main";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.mjsView on unpkg · L10

27const BACKEND_PATH = "apps/backend";

28const FRONTEND_PATH = "apps/frontend";

29const PROXY_PATH = "apps/proxy";

30const MIN_NODE_MAJOR = 22;

32// Default dev ports. Kept in sync with scripts/with-env.mjs and the proxy

33// template. .env.local is the runtime source of truth — these are the

34// installer-side fallbacks for computing initial URL defaults.

35const DEFAULT_PROXY_PORT = 3030;

36const DEFAULT_FRONTEND_PORT = 3001;

Lines 1388-1428javascript

1388 if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) {

1389 v = v.slice(1

Source & flagged code

3 flagged · loading source

index.mjsView file

Source & flagged code

3 flagged

index.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

3// create-apollo-monorepo — Zero-dependency scaffolder for an Apollo CMS monorepo

4// Usage: npx create-apollo-monorepo <directory> [flags]

5//

6// Produces:

7// <directory>/

8// ├── apps/

9// │ ├── frontend/ ← your app (pnpm workspace member)

10// │ └── backend/ ← git submodule → apollo-cms

11// ├── package.json

12// ├── pnpm-workspace.yaml

13// ├── .env.local

14// ├── .gitmodules

15// └── .gitignore

17import { execSync } from "node:child_process";

18import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

index.mjsView on unpkg · L16

19import { existsSync, mkdirSync, writeFileSync, symlinkSync, rmSync } from "node:fs";

20import { resolve, basename } from "node:path";

21import { createInterface } from "node:readline";

25const BACKEND_REPO_URL = "https://github.com/5Lab-Group-Co-Ltd/apollo-cms.git";

26const BACKEND_BRANCH = "main";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.mjsView on unpkg · L10

27const BACKEND_PATH = "apps/backend";

28const FRONTEND_PATH = "apps/frontend";

29const PROXY_PATH = "apps/proxy";

30const MIN_NODE_MAJOR = 22;

32// Default dev ports. Kept in sync with scripts/with-env.mjs and the proxy

33// template. .env.local is the runtime source of truth — these are the

34// installer-side fallbacks for computing initial URL defaults.

35const DEFAULT_PROXY_PORT = 3030;

36const DEFAULT_FRONTEND_PORT = 3001;

Lines 1388-1428javascript

1388 if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) {

1389 v = v.slice(1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code