registry / create-newt-app / 0.25.0
create-newt-app@0.25.0
⚠ Under review<div align="center"> <h1>newt-app</h1> <p><strong>Scaffold a production-ready, full-stack TypeScript monorepo in one command.</strong></p>
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 10 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
CryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
3 flaggeddist/index.jsView file
6L7: // package.json
L8: var package_default = {
...
L34: ejs: "^3.1.10",
L35: execa: "^9.6.0"
L36: },
...
L83: filename: ".gitignore",
L84: template: `# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
L85:
...
L389: // Load root .env first, then local .env (local takes precedence)
L390: dotenv.config({ path: resolve(process.cwd(), '../../.env') });
L391: dotenv.config({ path: resolve(process.cwd(), '.env') });
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L66Trigger-reachable chain: manifest.bin -> dist/index.js
L6:
L7: // package.json
L8: var package_default = {
...
L34: ejs: "^3.1.10",
L35: execa: "^9.6.0"
L36: },
...
L83: filename: ".gitignore",
L84: template: `# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
L85:
...
L389: // Load root .env first, then local .env (local takes precedence)
L390: dotenv.config({ path: resolve(process.cwd(), '../../.env') });
L391: dotenv.config({ path: resolve(process.cwd(), '.env') });
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L6Findings
2 Critical1 High3 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to create-newt-app@0.25.0.
See all versions of create-newt-app for other recorded verdicts.
- Review the evidence and your use of create-newt-app@0.25.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.