Loading npm security reports…

create-cedar-app: Suspicious npm security report (Warn) | LPM Firewall

registry / create-cedar-app / 7.0.0

create-cedar-app@7.0.0

<p align="center"> <img src="https://avatars.githubusercontent.com/u/211931789?s=200&v=4" width="200" /> <h1 align="center">CedarJS</h1> <p align="center"> <a href="https://cedarjs.com/discord"> <img src="https://img.shields.io/badge/Disco

AI Security Review

scanned 12d ago · by lpm-firewall-ai

No malicious attack surface was identified. The package is a user-invoked project generator with optional installation, database setup, and telemetry.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user explicitly runs the create-cedar-app command.

Impact

No unconsented install-time execution, credential harvesting, or destructive behavior was found.

Mechanism

The CLI creates a selected project, may install its dependencies, and optionally contacts the Neon database API or telemetry endpoint.

AI rationale

Static inspection found a normal user-invoked scaffolding CLI and no install lifecycle hook or concrete malicious behavior. Its observed network operations are tied to optional database creation and telemetry.

Network endpoints2

neon.new/api/v1/databasequark.quantumparticle.io/v1/traces

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Why the final policy warns

The AI recommended clean. Static policy retained a warning. The static scanner classified the package as malicious with confidence of at least 85%. A critical static finding has confidence of at least 90%. These conditions do not mean that the AI confirmed malicious behavior.

Source & flagged code

9 flagged · loading source

dist/create-cedar-app.jsView file

4Source sends the broad process environment to a literal external destination. L4: const __filename = (await import("node:url")).fileURLToPath(import.meta.url); L5: const __dirname = (await import("node:path")).dirname(__filename); L6: L7: var XG=Object.create;var pl=Object.defineProperty;var JG=Object.getOwnPropertyDescriptor;var QG=Object.getOwnPropertyNames;var ZG=Object.getPrototypeOf,e6=Object.prototype.hasOwnPr... L8: `:10,t=typeof r=="string"?"\r":13;return r[r.length-1]===e&&(r=r.slice(0,r.length-1)),r[r.length-1]===t&&(r=r.slice(0,r.length-1)),r}});var nO=P((Dye,Ac)=>{"use strict";var yc=W("p... L9: ${n.message}`:g,S=[_,e,r].filter(Boolean).join(` L10: `);return h?(n.originalMessage=n.message,n.message=S):n=new Error(S),n.shortMessage=_,n.command=o,n.escapedCommand=a,n.exitCode=s,

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/create-cedar-app.jsView on unpkg · L4

•matchType = previous_version_dangerous_delta matchedPackage = create-cedar-app@6.0.0 matchedIdentity = npm:Y3JlYXRlLWNlZGFyLWFwcA:6.0.0 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/create-cedar-app.jsView on unpkg

6L7: var XG=Object.create;var pl=Object.defineProperty;var JG=Object.getOwnPropertyDescriptor;var QG=Object.getOwnPropertyNames;var ZG=Object.getPrototypeOf,e6=Object.prototype.hasOwnPr... L8: `:10,t=typeof r=="string"?"\r":13;return r[r.length-1]===e&&(r=r.slice(0,r.length-1)),r[r.length-1]===t&&(r=r.slice(0,r.length-1)),r}});var nO=P((Dye,Ac)=>{"use strict";var yc=W("p... L9: ${n.message}`:g,S=[_,e,r].filter(Boolean).join(` L10: `);return h?(n.originalMessage=n.message,n.message=S):n=new Error(S),n.shortMessage=_,n.command=o,n.escapedCommand=a,n.exitCode=s,n.signal=i,n.signalDescription=f,n.stdout=r,n.stde... L11: `)];for(let[u,l]of c.entries()){if(n+=l,op.has(l)){let{groups:f}=new RegExp(`(?:\\${mC}(?<code>\\d+)m|\\${s_}(?<uri>.*)${n_})`).exec(c.slice(u).join(""))||{groups:{}};if(f.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/create-cedar-app.jsView on unpkg · L6

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/create-cedar-app.js: `);return h?(n.originalMessage=n.message,n.message=S):n=new Error(S),n.shortMessage=_,n.command=o,n.escapedCommand=a,n.exitCode=s,n.signal=i,n.signalDescription=f,n.stdout=r,n.stde... `+t,width:i=80}=e,s=(n+t).match(/[^\S\n]/g)||[];i-=s.length;let o=`.{1,${i}}([\\s\\u200B]+|$)|[^\\s\\u200B]+?([\\s\\u200B]+|$)`,a=r.trim(),c=new RegExp(o,"g"),u=a.match(c)||[];retu... `),i+=r.charAt(s);return t&&n&&(i=`${t}${i}${n}`),i}function Gg(r){return Ob(r,{stringWidth:e=>[...e].length,stripAnsi:kg,wrap:Cb})}import{dirname as Db,resolve as Pb}from"path";im... `));try{(await Pe.prompt({type:"select",name:"override-engine-err

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/create-cedar-app.jsView on unpkg

6L7: var XG=Object.create;var pl=Object.defineProperty;var JG=Object.getOwnPropertyDescriptor;var QG=Object.getOwnPropertyNames;var ZG=Object.getPrototypeOf,e6=Object.prototype.hasOwnPr... L8: `:10,t=typeof r=="string"?"\r":13;return r[r.length-1]===e&&(r=r.slice(0,r.length-1)),r[r.length-1]===t&&(r=r.slice(0,r.length-1)),r}});var nO=P((Dye,Ac)=>{"use strict";var yc=W("p... L9: ${n.message}`:g,S=[_,e,r].filter(Boolean).join(` L10: `);return h?(n.originalMessage=n.message,n.message=S):n=new Error(S),n.shortMessage=_,n.command=o,n.escapedCommand=a,n.exitCode=s,n.signal=i,n.signalDescription=f,n.stdout=r,n.stde... L11: `)];for(let[u,l]of c.entries()){if(n+=l,op.has(l)){let{groups:f}=new RegExp(`(?:\\${mC}(?<code>\\d+)m|\\${s_}(?<uri>.*)${n_})`).exec(c.slice(u).join(""))||{groups:{}};if(f.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/create-cedar-app.jsView on unpkg · L6

4const __filename = (await import("node:url")).fileURLToPath(import.meta.url); L5: const __dirname = (await import("node:path")).dirname(__filename); L6: L7: var XG=Object.create;var pl=Object.defineProperty;var JG=Object.getOwnPropertyDescriptor;var QG=Object.getOwnPropertyNames;var ZG=Object.getPrototypeOf,e6=Object.prototype.hasOwnPr... L8: `:10,t=typeof r=="string"?"\r":13;return r[r.length-1]===e&&(r=r.slice(0,r.length-1)),r[r.length-1]===t&&(r=r.slice(0,r.length-1)),r}});var nO=P((Dye,Ac)=>{"use strict";var yc=W("p... L9: ${n.message}`:g,S=[_,e,r].filter(Boolean).join(` L10: `);return h?(n.originalMessage=n.message,n.message=S):n=new Error(S),n.shortMessage=_,n.command=o,n.escapedCommand=a,n.exitCode=s,n.signal=i,n.signalDescription=f,n.stdout=r,n.stde... L11: `)];for(let[u,l]of

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/create-cedar-app.jsView on unpkg · L4

6Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/create-cedar-app.js L6: L7: var XG=Object.create;var pl=Object.defineProperty;var JG=Object.getOwnPropertyDescriptor;var QG=Object.getOwnPropertyNames;var ZG=Object.getPrototypeOf,e6=Object.prototype.hasOwnPr... L8: `:10,t=typeof r=="string"?"\r":13;return r[r.length-1]===e&&(r=r.slice(0,r.length-1)),r[r.length-1]===t&&(r=r.slice(0,r.length-1)),r}});var nO=P((Dye,Ac)=>{"use strict";var yc=W("p... L9: ${n.message}`:g,S=[_,e,r].filter(Boolean).join(` L10: `);return h?(n.originalMessage=n.message,n.message=S):n=new Error(S),n.shortMessage=_,n.command=o,n.escapedCommand=a,n.exitCode=s,n.signal=i,n.signalDescription=f,n.stdout=r,n.stde... L11: `)];for(let[u,l]of c.entries()){if(n+=l,op.has(l)){let{groups:f}=new RegExp(`(

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/create-cedar-app.jsView on unpkg · L6

•matchType = normalized_sha256 matchedPackage = create-cedar-app@6.0.2 matchedPath = dist/create-cedar-app.js matchedIdentity = npm:Y3JlYXRlLWNlZGFyLWFwcA:6.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/create-cedar-app.jsView on unpkg

2L3: const require = (await import("node:module")).createRequire(import.meta.url); L4: const __filename = (await import("node:url")).fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/create-cedar-app.jsView on unpkg · L2

Source & flagged code

9 flagged

dist/create-cedar-app.jsView file

4Source sends the broad process environment to a literal external destination. L4: const __filename = (await import("node:url")).fileURLToPath(import.meta.url); L5: const __dirname = (await import("node:path")).dirname(__filename); L6: L7: var XG=Object.create;var pl=Object.defineProperty;var JG=Object.getOwnPropertyDescriptor;var QG=Object.getOwnPropertyNames;var ZG=Object.getPrototypeOf,e6=Object.prototype.hasOwnPr... L8: `:10,t=typeof r=="string"?"\r":13;return r[r.length-1]===e&&(r=r.slice(0,r.length-1)),r[r.length-1]===t&&(r=r.slice(0,r.length-1)),r}});var nO=P((Dye,Ac)=>{"use strict";var yc=W("p... L9: ${n.message}`:g,S=[_,e,r].filter(Boolean).join(` L10: `);return h?(n.originalMessage=n.message,n.message=S):n=new Error(S),n.shortMessage=_,n.command=o,n.escapedCommand=a,n.exitCode=s,

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/create-cedar-app.jsView on unpkg · L4

•matchType = previous_version_dangerous_delta matchedPackage = create-cedar-app@6.0.0 matchedIdentity = npm:Y3JlYXRlLWNlZGFyLWFwcA:6.0.0 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/create-cedar-app.jsView on unpkg

6L7: var XG=Object.create;var pl=Object.defineProperty;var JG=Object.getOwnPropertyDescriptor;var QG=Object.getOwnPropertyNames;var ZG=Object.getPrototypeOf,e6=Object.prototype.hasOwnPr... L8: `:10,t=typeof r=="string"?"\r":13;return r[r.length-1]===e&&(r=r.slice(0,r.length-1)),r[r.length-1]===t&&(r=r.slice(0,r.length-1)),r}});var nO=P((Dye,Ac)=>{"use strict";var yc=W("p... L9: ${n.message}`:g,S=[_,e,r].filter(Boolean).join(` L10: `);return h?(n.originalMessage=n.message,n.message=S):n=new Error(S),n.shortMessage=_,n.command=o,n.escapedCommand=a,n.exitCode=s,n.signal=i,n.signalDescription=f,n.stdout=r,n.stde... L11: `)];for(let[u,l]of c.entries()){if(n+=l,op.has(l)){let{groups:f}=new RegExp(`(?:\\${mC}(?<code>\\d+)m|\\${s_}(?<uri>.*)${n_})`).exec(c.slice(u).join(""))||{groups:{}};if(f.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/create-cedar-app.jsView on unpkg · L6

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/create-cedar-app.js: `);return h?(n.originalMessage=n.message,n.message=S):n=new Error(S),n.shortMessage=_,n.command=o,n.escapedCommand=a,n.exitCode=s,n.signal=i,n.signalDescription=f,n.stdout=r,n.stde... `+t,width:i=80}=e,s=(n+t).match(/[^\S\n]/g)||[];i-=s.length;let o=`.{1,${i}}([\\s\\u200B]+|$)|[^\\s\\u200B]+?([\\s\\u200B]+|$)`,a=r.trim(),c=new RegExp(o,"g"),u=a.match(c)||[];retu... `),i+=r.charAt(s);return t&&n&&(i=`${t}${i}${n}`),i}function Gg(r){return Ob(r,{stringWidth:e=>[...e].length,stripAnsi:kg,wrap:Cb})}import{dirname as Db,resolve as Pb}from"path";im... `));try{(await Pe.prompt({type:"select",name:"override-engine-err

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/create-cedar-app.jsView on unpkg

6L7: var XG=Object.create;var pl=Object.defineProperty;var JG=Object.getOwnPropertyDescriptor;var QG=Object.getOwnPropertyNames;var ZG=Object.getPrototypeOf,e6=Object.prototype.hasOwnPr... L8: `:10,t=typeof r=="string"?"\r":13;return r[r.length-1]===e&&(r=r.slice(0,r.length-1)),r[r.length-1]===t&&(r=r.slice(0,r.length-1)),r}});var nO=P((Dye,Ac)=>{"use strict";var yc=W("p... L9: ${n.message}`:g,S=[_,e,r].filter(Boolean).join(` L10: `);return h?(n.originalMessage=n.message,n.message=S):n=new Error(S),n.shortMessage=_,n.command=o,n.escapedCommand=a,n.exitCode=s,n.signal=i,n.signalDescription=f,n.stdout=r,n.stde... L11: `)];for(let[u,l]of c.entries()){if(n+=l,op.has(l)){let{groups:f}=new RegExp(`(?:\\${mC}(?<code>\\d+)m|\\${s_}(?<uri>.*)${n_})`).exec(c.slice(u).join(""))||{groups:{}};if(f.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/create-cedar-app.jsView on unpkg · L6

4const __filename = (await import("node:url")).fileURLToPath(import.meta.url); L5: const __dirname = (await import("node:path")).dirname(__filename); L6: L7: var XG=Object.create;var pl=Object.defineProperty;var JG=Object.getOwnPropertyDescriptor;var QG=Object.getOwnPropertyNames;var ZG=Object.getPrototypeOf,e6=Object.prototype.hasOwnPr... L8: `:10,t=typeof r=="string"?"\r":13;return r[r.length-1]===e&&(r=r.slice(0,r.length-1)),r[r.length-1]===t&&(r=r.slice(0,r.length-1)),r}});var nO=P((Dye,Ac)=>{"use strict";var yc=W("p... L9: ${n.message}`:g,S=[_,e,r].filter(Boolean).join(` L10: `);return h?(n.originalMessage=n.message,n.message=S):n=new Error(S),n.shortMessage=_,n.command=o,n.escapedCommand=a,n.exitCode=s,n.signal=i,n.signalDescription=f,n.stdout=r,n.stde... L11: `)];for(let[u,l]of

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/create-cedar-app.jsView on unpkg · L4

6Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/create-cedar-app.js L6: L7: var XG=Object.create;var pl=Object.defineProperty;var JG=Object.getOwnPropertyDescriptor;var QG=Object.getOwnPropertyNames;var ZG=Object.getPrototypeOf,e6=Object.prototype.hasOwnPr... L8: `:10,t=typeof r=="string"?"\r":13;return r[r.length-1]===e&&(r=r.slice(0,r.length-1)),r[r.length-1]===t&&(r=r.slice(0,r.length-1)),r}});var nO=P((Dye,Ac)=>{"use strict";var yc=W("p... L9: ${n.message}`:g,S=[_,e,r].filter(Boolean).join(` L10: `);return h?(n.originalMessage=n.message,n.message=S):n=new Error(S),n.shortMessage=_,n.command=o,n.escapedCommand=a,n.exitCode=s,n.signal=i,n.signalDescription=f,n.stdout=r,n.stde... L11: `)];for(let[u,l]of c.entries()){if(n+=l,op.has(l)){let{groups:f}=new RegExp(`(

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/create-cedar-app.jsView on unpkg · L6

•matchType = normalized_sha256 matchedPackage = create-cedar-app@6.0.2 matchedPath = dist/create-cedar-app.js matchedIdentity = npm:Y3JlYXRlLWNlZGFyLWFwcA:6.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/create-cedar-app.jsView on unpkg

2L3: const require = (await import("node:module")).createRequire(import.meta.url); L4: const __filename = (await import("node:url")).fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/create-cedar-app.jsView on unpkg · L2