registry / create-newt-app / 0.31.4

create-newt-app@0.31.4

<div align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/zeevo/newt-app/main/.github/assets/logo-dark.svg"> <img src="https://raw.githubusercontent.com/zeevo/newt-app/main/.github/asse

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The scanner’s credential-exfiltration hint is not supported by the inspected source: the CLI generates project files and a local authentication secret, with no identified credential-sending path. The manifest has no install hook, and reviewed dependency entrypoints show ordinary prompt, formatting, and command-parsing behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user invokes the project-generation CLI.

Impact

No credential transfer or other confirmed attack effect was found in the inspected source.

Mechanism

The CLI writes selected project templates and can optionally run the package manager and initialize a Git repository.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes a CLI entrypoint and has no install lifecycle hook.
The CLI generates a project using selected template settings and a random local authentication secret.
Project installation runs only when the user leaves the install option enabled.
The reviewed prompt and terminal-formatting dependencies expose expected package entrypoints; their manifests show no install hooks.
The command parser dependency’s ESM entrypoint re-exports command-line parser APIs.

Evidence against

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 448 KB of source, external domains: git-scm.com, github.com, help.github.com, json.schemastore.org, nestjs.com, newt-app.com, nextjs.org, raw.githubusercontent.com, turborepo.dev, ui.shadcn.com, vercel.com, www.w3.org

Source & flagged code

5 flagged

dist/index.jsView file

7import { randomBytes } from "node:crypto"; L8: import { execa } from "execa"; L9: import ejs from "ejs"; ... L11: import path from "path"; L12: //#region package.json L13: var version = "0.31.4"; ... L48: filename: ".gitignore", L49: template: `# See https://help.github.com/articles/ignoring-files/ for more about ignoring files. L50: ... L196: <% } %>BETTER_AUTH_URL=http://localhost:3000 L197: BETTER_AUTH_SECRET=generate-with-openssl-rand-base64-32 L198: `

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L7

7Trigger-reachable chain: manifest.bin -> dist/index.js L7: import { randomBytes } from "node:crypto"; L8: import { execa } from "execa"; L9: import ejs from "ejs"; ... L11: import path from "path"; L12: //#region package.json L13: var version = "0.31.4"; ... L48: filename: ".gitignore", L49: template: `# See https://help.github.com/articles/ignoring-files/ for more about ignoring files. L50: ... L196: <% } %>BETTER_AUTH_URL=http://localhost:3000 L197: BETTER_AUTH_SECRET=generate-with-openssl-rand-base64-32 L198: `

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L7

Findings

2 Critical1 High3 Medium6 Low

CriticalCredential Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighTrigger Reachable Credential Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to create-newt-app@0.31.4.

See all versions of create-newt-app for other recorded verdicts.

Review the evidence and your use of create-newt-app@0.31.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-24 12:23:46.459Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / create-newt-app / 0.31.4

create-newt-app@0.31.4

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user invokes the project-generation CLI.

Impact

No credential transfer or other confirmed attack effect was found in the inspected source.

Mechanism

The CLI writes selected project templates and can optionally run the package manager and initialize a Git repository.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes a CLI entrypoint and has no install lifecycle hook.
The CLI generates a project using selected template settings and a random local authentication secret.
Project installation runs only when the user leaves the install option enabled.
The reviewed prompt and terminal-formatting dependencies expose expected package entrypoints; their manifests show no install hooks.
The command parser dependency’s ESM entrypoint re-exports command-line parser APIs.

Evidence against

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

5 flagged

dist/index.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L7

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L7

Findings

2 Critical1 High3 Medium6 Low

CriticalCredential Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighTrigger Reachable Credential Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to create-newt-app@0.31.4.

See all versions of create-newt-app for other recorded verdicts.

Review the evidence and your use of create-newt-app@0.31.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-24 12:23:46.459Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.