create-newt-app@0.26.0

⚠ Under review

<div align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/zeevo/newt-app/main/.github/assets/logo-dark.svg"> <img src="https://raw.githubusercontent.com/zeevo/newt-app/main/.github/asse

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 10 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 391 KB of source, external domains: git-scm.com, github.com, help.github.com, json.schemastore.org, nestjs.com, newt-app.com, nextjs.org, raw.githubusercontent.com, turborepo.dev, ui.shadcn.com, vercel.com, www.w3.org

Source & flagged code

3 flagged

dist/index.jsView file

6L7: // package.json L8: var package_default = { ... L34: ejs: "^3.1.10", L35: execa: "^9.6.0" L36: }, ... L83: filename: ".gitignore", L84: template: `# See https://help.github.com/articles/ignoring-files/ for more about ignoring files. L85: ... L389: // Load root .env first, then local .env (local takes precedence) L390: dotenv.config({ path: resolve(process.cwd(), '../../.env') }); L391: dotenv.config({ path: resolve(process.cwd(), '.env') });

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L6

6Trigger-reachable chain: manifest.bin -> dist/index.js L6: L7: // package.json L8: var package_default = { ... L34: ejs: "^3.1.10", L35: execa: "^9.6.0" L36: }, ... L83: filename: ".gitignore", L84: template: `# See https://help.github.com/articles/ignoring-files/ for more about ignoring files. L85: ... L389: // Load root .env first, then local .env (local takes precedence) L390: dotenv.config({ path: resolve(process.cwd(), '../../.env') }); L391: dotenv.config({ path: resolve(process.cwd(), '.env') });

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L6

Findings

2 Critical1 High3 Medium4 Low

CriticalCredential Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighTrigger Reachable Credential Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to create-newt-app@0.26.0.

See all versions of create-newt-app for other recorded verdicts.

Review the evidence and your use of create-newt-app@0.26.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-07 07:25:49.638Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / create-newt-app / 0.26.0

create-newt-app@0.26.0

⚠ Under review

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 10 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

3 flagged

dist/index.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L6

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L6

Findings

2 Critical1 High3 Medium4 Low

CriticalCredential Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighTrigger Reachable Credential Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to create-newt-app@0.26.0.

See all versions of create-newt-app for other recorded verdicts.

Review the evidence and your use of create-newt-app@0.26.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-07 07:25:49.638Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.