registry / zova-cli-set-front / 1.2.115
zova-cli-set-front@1.2.115
zova cli-set-front
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe manifest exposes a JavaScript entry point and has no install-time lifecycle hook. The inspected entry-point behavior is a frontend CLI command catalog with project-scoped build operations, and I found no concrete malicious behavior.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
No install-time hook is declared; project build operations run through an invoked CLI command.
Impact
No malicious impact identified. Invoked build commands can modify project build files as expected for a CLI tool.
Mechanism
The entry point exports frontend CLI commands and build helpers; no credential collection, unrelated network contact, or concealed code was identified.
AI rationale
The manifest exposes a JavaScript entry point and has no install-time lifecycle hook. The inspected entry-point behavior is a frontend CLI command catalog with project-scoped build operations, and I found no concrete malicious behavior.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exports a JavaScript module and declares no install, preinstall, or postinstall hook; its build scripts are for publishing.
- The entry-point code implements project build operations using the project path supplied to an invoked CLI command.
- The module exports a catalog of frontend CLI commands, consistent with the package description.
Evidence against
- The CLI has filesystem and build capabilities, including removing a project dist directory when its build command runs; these actions are consistent with its stated purpose.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedpackage.jsonView file
•devDependencies registry_only=clean-package,rimraf
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkg17"type": "module",
"exports": {
".": {
"types": "./dist/index.d.ts",
"default": "./dist/index.js"
},
"./package.json": "./package.json"
},
"publishConfig": {
"access": "public"
},
"scripts": {
"clean": "rimraf dist dist-cli
Low
Suspicious Lifecycle Evidence
The package exports a JavaScript module and declares no install, preinstall, or postinstall hook; its build scripts are for publishing.
package.jsonView on unpkg · L17dist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = zova-cli-set-front@1.2.106
matchedIdentity = npm:em92YS1jbGktc2V0LWZyb250:1.2.106
similarity = 0.917
summary = stored previous version shares package body but lacks this dangerous source file
Findings
1 Critical1 High1 Medium8 Low
CriticalManifest Confusionpackage.json
HighPrevious Version Dangerous Deltadist/index.js
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to zova-cli-set-front@1.2.115.
See all versions of zova-cli-set-front for other recorded verdicts.
- Review the evidence and your use of zova-cli-set-front@1.2.115 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.