registry / create-zuplo-api / 7.8.17
create-zuplo-api@7.8.17
Create Zuplo API with one command
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe agent integration is explicitly selected and defaults to no agents in noninteractive mode, but it writes agent configuration and installs remote skills into generated projects. This is a concrete guarded agent-extension capability, not evidence of malware.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the project-creation command and selects agents or supplies the corresponding agent option.
Impact
Selected projects gain agent extensions and a Zuplo documentation MCP endpoint; this is a guarded extension lifecycle risk rather than a confirmed attack.
Mechanism
The command writes MCP and agent instruction files, enables Zuplo-related agent configuration, and can install downloaded skills.
AI rationale
The agent integration is explicitly selected and defaults to no agents in noninteractive mode, but it writes agent configuration and installs remote skills into generated projects. This is a concrete guarded agent-extension capability, not evidence of malware.
Evidence
package.jsondist/index.js.mcp.json.claude/settings.jsonCLAUDE.mdAGENTS.md.agents/skills
Network endpoints2
dev.zuplo.com/mcp/docscodeload.github.com/zuplo/tools/tar.gz/main
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest exposes a command-line entrypoint and contains only development and build scripts, with no install lifecycle hook.
- The command asks the user which AI coding agents to configure; noninteractive mode leaves the agent list empty.
- When agents are selected, the command writes project MCP and agent configuration files and installs skills.
- The generated MCP configuration points to Zuplo's documentation endpoint.
Evidence against
- The agent setup is user-selected during project creation rather than run automatically on package installation.
- No credential collection or unrelated data export was identified in the inspected setup path.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
8 flaggeddist/index.jsView file
1#!/usr/bin/env node
L2: (()=>{var t={7213:(t,u,p)=>{"use strict";Object.defineProperty(u,"__esModule",{value:true});u.createFileSystemAdapter=u.FILE_SYSTEM_ADAPTER=void 0;const m=p(9896);u.FILE_SYSTEM_ADA...
L3: || (${w} == "string" && ${g} && ${g} == +${g})`).assign(E,(0,b._)`+${g}`);return;case"integer":m.elseIf((0,b._)`${w} === "boolean" || ${g} === null
L4: || (${w} === "string" && ${g} && ${g} == +${g} && !(${g} % 1))`).assign(E,(0,b._)`+${g}`);return;case"boolean":m.elseIf((0,b._)`${g} === "false" || ${g} === 0 || ${g} === null`).as...
L5: || ${w} === "boolean" || ${g} === null`).assign(E,(0,b._)`[${g}]`)}}}function assignParentData({gen:t,parentData:u,parentDataProperty:p},m){t.if((0,b._)`${u} !== undefined`,(()=>t....
L6: missingProperty: ${g},
L7: depsCount: ${u},
L8: deps: ${
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L11Trigger-reachable chain: manifest.bin -> dist/index.js
L1: #!/usr/bin/env node
L2: (()=>{var t={7213:(t,u,p)=>{"use strict";Object.defineProperty(u,"__esModule",{value:true});u.createFileSystemAdapter=u.FILE_SYSTEM_ADAPTER=void 0;const m=p(9896);u.FILE_SYSTEM_ADA...
L3: || (${w} == "string" && ${g} && ${g} == +${g})`).assign(E,(0,b._)`+${g}`);return;case"integer":m.elseIf((0,b._)`${w} === "boolean" || ${g} === null
L4: || (${w} === "string" && ${g} && ${g} == +${g} && !(${g} % 1))`).assign(E,(0,b._)`+${g}`);return;case"boolean":m.elseIf((0,b._)`${g} === "false" || ${g} === 0 || ${g} === null`).as...
L5: || ${w} === "boolean" || ${g} === null`).assign(E,(0,b._)`[${g}]`)}}}function assignParentData({gen:t,parentData:u,parentDataProperty:p},m){t.if((0,b._)`${u} !== undefined`,(()=>t....
L6: m
Findings
2 Critical6 High3 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighEvaldist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to create-zuplo-api@7.8.17.
See all versions of create-zuplo-api for other recorded verdicts.
- Review the evidence and your use of create-zuplo-api@7.8.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.