create-express-modular@3.3.10
Scaffold a modular, domain-driven Express + TypeScript backend. Choose your database (Mongoose, Prisma, or Drizzle) and validator (Zod or Joi). Optionally add JWT auth and Docker setup.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe CLI sends default-on runtime telemetry that is not disclosed in the reviewed documentation, so this is suspicious under the telemetry rule. The source does not support the credential-redirection or command-output-exfiltration claims; the observed payload contains only ordinary metadata and a random identifier.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the CLI to scaffold a project; telemetry is enabled by default and can be disabled with CEM_TELEMETRY=off.
Impact
The service receives usage and platform metadata without disclosure in the reviewed README or DOCS.
Mechanism
The CLI POSTs a create event, package and runtime versions, package manager, platform and architecture, and a random UUID.
AI rationale
The CLI sends default-on runtime telemetry that is not disclosed in the reviewed documentation, so this is suspicious under the telemetry rule. The source does not support the credential-redirection or command-output-exfiltration claims; the observed payload contains only ordinary metadata and a random identifier.
Evidence
dist/bin/cli.jspackage.json
Network endpoints1
create-express-modular.lovable.app
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package exposes dist/bin/cli.js as its CLI and has no install, preinstall, or postinstall hook.
- The CLI sends a default-on telemetry POST with command, version, package-manager, runtime, platform, and random UUID fields; CEM_TELEMETRY=off disables it.
- The telemetry call follows successful project scaffolding and sends the fixed create event.
Evidence against
- The request contains no credentials, command output, file contents, paths, or user or project identifiers.
- The package is a CLI scaffolder, and the telemetry fields are limited to ordinary usage and platform metadata.
- The package has no install-time telemetry hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
6 flaggeddist/bin/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = create-express-modular@3.3.6
matchedIdentity = npm:Y3JlYXRlLWV4cHJlc3MtbW9kdWxhcg:3.3.6
similarity = 0.690
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/bin/cli.jsView on unpkg1#!/usr/bin/env node
L2: 'use strict';var le=require('fs'),Ie=require('path'),child_process=require('child_process'),util=require('util'),z3=require('https'),wb=require('os'),crypto=require('crypto');funct...
L3: `),{succeed:s=>xe(s),fail:s=>De(s)};let r=["\u280B","\u2819","\u2839","\u2838","\u283C","\u2834","\u2826","\u2827","\u2807","\u280F"],t=0,n=" ".repeat(e.length+12),i=setInterval(()...
High
1#!/usr/bin/env node
L2: 'use strict';var le=require('fs'),Ie=require('path'),child_process=require('child_process'),util=require('util'),z3=require('https'),wb=require('os'),crypto=require('crypto');funct...
L3: `),{succeed:s=>xe(s),fail:s=>De(s)};let r=["\u280B","\u2819","\u2839","\u2838","\u283C","\u2834","\u2826","\u2827","\u2807","\u280F"],t=0,n=" ".repeat(e.length+12),i=setInterval(()...
L4: `).forEach(i=>{let o=Sb(i);o!==null&&console.log(o);});}),t.stderr.setEncoding("utf8"),t.stderr.on("data",n=>{n.split(`
Findings
1 Critical6 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/bin/cli.js
HighChild Processdist/bin/cli.js
HighShell
HighSame File Env Network Executiondist/bin/cli.js
HighCredential Redirect Persistencedist/bin/cli.js
HighCommand Output Exfiltrationdist/bin/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/bin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to create-express-modular@3.3.10.
See all versions of create-express-modular for other recorded verdicts.
- Review the evidence and your use of create-express-modular@3.3.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.