registry / create-zuplo-api / 7.12.6
create-zuplo-api@7.12.6
Create Zuplo API with one command
AI Security Review
scanned 14d ago · by lpm-firewall-aiSource inspection found no lifecycle hook and no confirmed attack in the active CLI path. The flagged token-transfer helper has no caller in the inspected bundle; the reachable analytics event sends setup metadata and can be disabled with ZUPLO_DO_NOT_TRACK.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running the create-zuplo-api CLI.
Impact
The observed analytics request shares setup metadata; no confirmed credential disclosure or other attack impact was established.
Mechanism
The CLI posts package version and setup choices to its configured analytics endpoint. A separate token-reading and account-fetching helper is present in the bundle, but no caller was found.
AI rationale
Source inspection found no lifecycle hook and no confirmed attack in the active CLI path. The flagged token-transfer helper has no caller in the inspected bundle; the reachable analytics event sends setup metadata and can be disabled with ZUPLO_DO_NOT_TRACK.
Evidence
package.jsondist/index.js
Network endpoints1
app.posthog.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes dist/index.js as the CLI and declares no lifecycle hook.
- The CLI sends opt-out-controlled analytics to app.posthog.com.
- The analytics event contains setup choices and package version, with no credentials or environment values in the event properties.
- The bundle contains code that reads a saved Zuplo token and sends it to an environment-configurable API endpoint, but source searches found no callers of that token-reading or account-fetching helper.
Evidence against
- The manifest’s bin points to the CLI; the token-transfer helper appears only as a definition in the inspected bundle, with no activation path found.
- No install-time behavior or confirmed credential transfer from the active CLI path was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinified
Source & flagged code
8 flaggeddist/index.jsView file
1#!/usr/bin/env node
L2: (()=>{var t={7213:(t,u,p)=>{"use strict";Object.defineProperty(u,"__esModule",{value:true});u.createFileSystemAdapter=u.FILE_SYSTEM_ADAPTER=void 0;const m=p(9896);u.FILE_SYSTEM_ADA...
L3: || (${w} == "string" && ${g} && ${g} == +${g})`).assign(E,(0,b._)`+${g}`);return;case"integer":m.elseIf((0,b._)`${w} === "boolean" || ${g} === null
L4: || (${w} === "string" && ${g} && ${g} == +${g} && !(${g} % 1))`).assign(E,(0,b._)`+${g}`);return;case"boolean":m.elseIf((0,b._)`${g} === "false" || ${g} === 0 || ${g} === null`).as...
L5: || ${w} === "boolean" || ${g} === null`).assign(E,(0,b._)`[${g}]`)}}}function assignParentData({gen:t,parentData:u,parentDataProperty:p},m){t.if((0,b._)`${u} !== undefined`,(()=>t....
L6: missingProperty: ${g},
L7: depsCount: ${u},
L8: deps: ${
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L11Trigger-reachable chain: manifest.bin -> dist/index.js
L1: #!/usr/bin/env node
L2: (()=>{var t={7213:(t,u,p)=>{"use strict";Object.defineProperty(u,"__esModule",{value:true});u.createFileSystemAdapter=u.FILE_SYSTEM_ADAPTER=void 0;const m=p(9896);u.FILE_SYSTEM_ADA...
L3: || (${w} == "string" && ${g} && ${g} == +${g})`).assign(E,(0,b._)`+${g}`);return;case"integer":m.elseIf((0,b._)`${w} === "boolean" || ${g} === null
L4: || (${w} === "string" && ${g} && ${g} == +${g} && !(${g} % 1))`).assign(E,(0,b._)`+${g}`);return;case"boolean":m.elseIf((0,b._)`${g} === "false" || ${g} === 0 || ${g} === null`).as...
L5: || ${w} === "boolean" || ${g} === null`).assign(E,(0,b._)`[${g}]`)}}}function assignParentData({gen:t,parentData:u,parentDataProperty:p},m){t.if((0,b._)`${u} !== undefined`,(()=>t....
L6: m
Findings
2 Critical6 High3 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighEvaldist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to create-zuplo-api@7.12.6.
See all versions of create-zuplo-api for other recorded verdicts.
- Review the evidence and your use of create-zuplo-api@7.12.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.