registry / zova-cli-set-front / 1.2.110
zova-cli-set-front@1.2.110
zova cli-set-front
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe manifest and distribution describe a project CLI with command-driven build and code-generation behavior. The scanner leads reviewed did not reveal install-time contact, credential collection, or unrelated execution.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Import exposes the CLI API; project file operations occur when users run the relevant commands.
Impact
Expected project-generation and build changes; no evidence of unrelated data collection or account actions.
Mechanism
Commands build and copy project artifacts, or generate and refactor application files.
AI rationale
The manifest and distribution describe a project CLI with command-driven build and code-generation behavior. The scanner leads reviewed did not reveal install-time contact, credential collection, or unrelated execution.
Evidence
dist/index.jscli/templates/rest/rest.ts
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exports dist/index.js; its scripts build and clean generated CLI artifacts.
- The distribution exposes framework CLI commands and build, create, init, refactor, tools and OpenAPI functions.
- The changed REST template code adds schema rendering options by passing values to the existing schema helper.
Evidence against
- The manifest has no install, preinstall or postinstall hook; its lifecycle scripts are publishing and packing tasks.
- The distribution uses environment variables to name build output and optional copy destinations, and copies generated build files there.
- Narrow searches in dist/index.js found no fetch, child_process, eval or encoded-payload execution patterns.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
•devDependencies registry_only=clean-package,rimraf
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkg18"exports": {
".": {
"types": "./dist/index.d.ts",
"default": "./dist/index.js"
},
"./package.json": "./package.json"
},
"publishConfig": {
"access": "public"
},
"scripts": {
"clean": "rimraf dist dist-cli tsconfig.build.tsbuildinfo tsconfig.cli.tsbuildinfo",
"tsc:publish": "npm run clean && node ../../../vona/packages-cli/cli/src/bin/vona.ts :bin:buildGeneral && tsc -p tsconfig.build.json &&
Low
Ai Review Evidence
The package exports dist/index.js; its scripts build and clean generated CLI artifacts.
package.jsonView on unpkg · L18dist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = zova-cli-set-front@1.2.106
matchedIdentity = npm:em92YS1jbGktc2V0LWZyb250:1.2.106
similarity = 0.938
summary = stored previous version shares package body but lacks this dangerous source file
Findings
1 Critical1 High1 Medium9 Low
CriticalManifest Confusionpackage.json
HighPrevious Version Dangerous Deltadist/index.js
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencecli/templates/rest/rest.ts
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to zova-cli-set-front@1.2.110.
See all versions of zova-cli-set-front for other recorded verdicts.
- Review the evidence and your use of zova-cli-set-front@1.2.110 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.