registry / create-zuplo-api / 7.4.6
create-zuplo-api@7.4.6
Create Zuplo API with one command
AI Security Review
scanned 2mo ago · by lpm-firewall-aiScanner labels come from one ncc-bundled create CLI that combines env, fetch, spawn, and Ajv Function; source shows no install hooks and token use only against the Zuplo developer API. Remaining spawn, analytics, and opt-in project-local agent files are package-aligned user-invoked setup, so the package is clean.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user runs create-zuplo-api or npm create zuplo-api; npm install of this package does not run lifecycle scripts.
Impact
No confirmed unconsented harvesting, exfiltration, or install-time agent hijack.
Mechanism
Interactive project scaffolding with first-party Zuplo API and optional local agent files
AI rationale
Scanner labels come from one ncc-bundled create CLI that combines env, fetch, spawn, and Ajv Function; source shows no install hooks and token use only against the Zuplo developer API. Remaining spawn, analytics, and opt-in project-local agent files are package-aligned user-invoked setup, so the package is clean.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines an explicit create-zuplo-api CLI, ships only dist and docs, and has no preinstall, install, or postinstall scripts and no runtime dependencies.
- The bundled CLI reads a local Zuplo auth.json access token and sends it as a Bearer header to the Zuplo developer API, defaulting to https://dev.zuplo.com.
- AI-agent files are written only after an interactive agent prompt or --agents; non-interactive --yes mode leaves agents empty.
- Optional project MCP config points at https://dev.zuplo.com/mcp/docs, and selected skills are copied as SKILL.md from the first-party zuplo/tools tarball.
- Telemetry posts package-manager usage to PostHog unless ZUPLO_DO_NOT_TRACK is set; no webhook or secret-harvest sink is present.
- child_process is used for git init, package install, and npx zuplo in the project the user asked to create.
Evidence against
- The ncc-minified dist/index.js puts Ajv new Function, spawn, env, and fetch in one file, which is why scanners labeled credential exfiltration and eval.
- ZUPLO_DEVELOPER_API_ENDPOINT can override the developer API host without a hostname allowlist.
- When the user selects agents, the CLI downloads an unpinned GitHub main tarball and writes project-local agent files.
Source & flagged code
8 flaggeddist/index.jsView file
1#!/usr/bin/env node
L2: (()=>{var t={7213:(t,u,p)=>{"use strict";Object.defineProperty(u,"__esModule",{value:true});u.createFileSystemAdapter=u.FILE_SYSTEM_ADAPTER=void 0;const m=p(9896);u.FILE_SYSTEM_ADA...
L3: || (${w} == "string" && ${g} && ${g} == +${g})`).assign(E,(0,b._)`+${g}`);return;case"integer":m.elseIf((0,b._)`${w} === "boolean" || ${g} === null
L4: || (${w} === "string" && ${g} && ${g} == +${g} && !(${g} % 1))`).assign(E,(0,b._)`+${g}`);return;case"boolean":m.elseIf((0,b._)`${g} === "false" || ${g} === 0 || ${g} === null`).as...
L5: || ${w} === "boolean" || ${g} === null`).assign(E,(0,b._)`[${g}]`)}}}function assignParentData({gen:t,parentData:u,parentDataProperty:p},m){t.if((0,b._)`${u} !== undefined`,(()=>t....
L6: missingProperty: ${g},
L7: depsCount: ${u},
L8: deps: ${
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L11Trigger-reachable chain: manifest.bin -> dist/index.js
L1: #!/usr/bin/env node
L2: (()=>{var t={7213:(t,u,p)=>{"use strict";Object.defineProperty(u,"__esModule",{value:true});u.createFileSystemAdapter=u.FILE_SYSTEM_ADAPTER=void 0;const m=p(9896);u.FILE_SYSTEM_ADA...
L3: || (${w} == "string" && ${g} && ${g} == +${g})`).assign(E,(0,b._)`+${g}`);return;case"integer":m.elseIf((0,b._)`${w} === "boolean" || ${g} === null
L4: || (${w} === "string" && ${g} && ${g} == +${g} && !(${g} % 1))`).assign(E,(0,b._)`+${g}`);return;case"boolean":m.elseIf((0,b._)`${g} === "false" || ${g} === 0 || ${g} === null`).as...
L5: || ${w} === "boolean" || ${g} === null`).assign(E,(0,b._)`[${g}]`)}}}function assignParentData({gen:t,parentData:u,parentDataProperty:p},m){t.if((0,b._)`${u} !== undefined`,(()=>t....
L6: m
Findings
2 Critical6 High3 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighEvaldist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to create-zuplo-api@7.4.6.
See all versions of create-zuplo-api for other recorded verdicts.
- Review the evidence and your use of create-zuplo-api@7.4.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.