registry / zova-cli-set-front / 1.2.111

zova-cli-set-front@1.2.111

zova cli-set-front

AI Security Review

scanned 1d ago · by lpm-firewall-ai

The manifest exposes a CLI bundle and its only lifecycle build runs at publish time; the inspected bundle and changed template support expected build and OpenAPI-generation functions. The reported manifest discrepancy could not be independently verified from the available package source, and the inspected files showed no malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

CLI commands run when explicitly invoked; the publish build runs during prepublishOnly.

Impact

Expected project build or generation changes when the corresponding command is run.

Mechanism

The inspected code builds project assets and generates files from project configuration; no automatic collection or unrelated network behavior was found.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package exports dist/index.js as its main entry and declares no install, preinstall, or postinstall hook.
The only lifecycle scripts are prepublishOnly, prepack, and postpack; the publish hook builds the package.
The bundle exports CLI command definitions, including build, generation, refactor, and OpenAPI commands.
The changed OpenAPI template reads only API_BASE_URL and OPENAPI_SOURCE_URL to form a Swagger source URL.

Evidence against

The bundle’s APP_VERSION and BUILD_REST_COPY_DIST environment reads are used for build output naming and optional copying.
No malicious behavior was identified in the inspected entry point, lifecycle scripts, or changed template.

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 46 file(s), 173 KB of source, external domains: www.w3.org

Source & flagged code

6 flagged

package.jsonView file

•devDependencies registry_only=clean-package,rimraf

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

18"exports": { ".": { "types": "./dist/index.d.ts", "default": "./dist/index.js" }, "./package.json": "./package.json" }, "publishConfig": { "access": "public" }, "scripts": { "clean": "rimraf dist dist-cli tsconfig.build.tsbuildinfo tsconfig.cl

Low

Suspicious Lifecycle Evidence

The package exports dist/index.js as its main entry and declares no install, preinstall, or postinstall hook.

package.jsonView on unpkg · L18

28"scripts": { "clean": "rimraf dist dist-cli tsconfig.build.tsbuildinfo tsconfig.cli.tsbuildinfo", "tsc:publish": "npm run clean && node ../../../vona/packages-cli/cli/src/bin/vona.ts :bin:buildGeneral && tsc -p tsconfig.build.json && tsc -p tsconfig.cli.json", "prepublishOnly": "npm ru

Low

Suspicious Lifecycle Evidence

The only lifecycle scripts are prepublishOnly, prepack, and postpack; the publish hook builds the package.

Findings

1 Critical1 High1 Medium9 Low

CriticalManifest Confusionpackage.json

HighPrevious Version Dangerous Deltadist/index.js

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

LowAi Review Evidencecli/templates/openapi/config/boilerplate/project/openapi.config.ts

Affected versions and remediation

This report applies to zova-cli-set-front@1.2.111.

See all versions of zova-cli-set-front for other recorded verdicts.

Review the evidence and your use of zova-cli-set-front@1.2.111 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-03 14:31:14.235Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / zova-cli-set-front / 1.2.111

zova-cli-set-front@1.2.111

zova cli-set-front

AI Security Review

scanned 1d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

CLI commands run when explicitly invoked; the publish build runs during prepublishOnly.

Impact

Expected project build or generation changes when the corresponding command is run.

Mechanism

The inspected code builds project assets and generates files from project configuration; no automatic collection or unrelated network behavior was found.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package exports dist/index.js as its main entry and declares no install, preinstall, or postinstall hook.
The only lifecycle scripts are prepublishOnly, prepack, and postpack; the publish hook builds the package.
The bundle exports CLI command definitions, including build, generation, refactor, and OpenAPI commands.
The changed OpenAPI template reads only API_BASE_URL and OPENAPI_SOURCE_URL to form a Swagger source URL.

Evidence against

The bundle’s APP_VERSION and BUILD_REST_COPY_DIST environment reads are used for build output naming and optional copying.
No malicious behavior was identified in the inspected entry point, lifecycle scripts, or changed template.

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 46 file(s), 173 KB of source, external domains: www.w3.org

Source & flagged code

6 flagged

package.jsonView file

•devDependencies registry_only=clean-package,rimraf

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

Low

Suspicious Lifecycle Evidence

The package exports dist/index.js as its main entry and declares no install, preinstall, or postinstall hook.

package.jsonView on unpkg · L18

Low

Suspicious Lifecycle Evidence

The only lifecycle scripts are prepublishOnly, prepack, and postpack; the publish hook builds the package.

Findings

1 Critical1 High1 Medium9 Low

CriticalManifest Confusionpackage.json

HighPrevious Version Dangerous Deltadist/index.js

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

LowAi Review Evidencecli/templates/openapi/config/boilerplate/project/openapi.config.ts

Affected versions and remediation

This report applies to zova-cli-set-front@1.2.111.

See all versions of zova-cli-set-front for other recorded verdicts.

Review the evidence and your use of zova-cli-set-front@1.2.111 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-03 14:31:14.235Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.