registry / create-faiz-ui / 0.4.0

create-faiz-ui@0.4.0

Scaffold a new faiz-ui project — TanStack Start or Next.js + React 19 + Tailwind v4 + shadcn starter kit.

AI Security Review

scanned 8h ago · by lpm-firewall-ai

The invoked scaffolding CLI transmits a user-supplied access token to its validation service. This is an undisclosed credential-transfer gate, but no install-time execution or broader collection was found.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs the create-faiz-ui CLI with --token, FAIZ_UI_TOKEN, or an interactive token.

Impact

The supplied token is disclosed to the endpoint before project creation.

Mechanism

POST token validation to a remote Worker endpoint

Rationale

The dedicated token flow may be legitimate access control, but its undisclosed remote transmission creates a concrete credential-exposure risk that source inspection cannot resolve. No evidence supports a malicious install-time or broader exfiltration chain.

Evidence

package.jsonREADME.mdbin/index.jstemplate/package.jsontemplate-next/package.jsontemplatetemplate-next

Network endpoints1

create-faiz-ui-tokens.faizintifada.workers.dev/validate

Decision evidence

public snapshot

AI called this at 84.0% confidence with false-positive risk.

create-faiz-ui@0.4.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code