registry / zova-cli-set-front / 1.2.121
zova-cli-set-front@1.2.121
zova cli-set-front
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe manifest has no install-time hook, and the exported functionality matches frontend CLI and build workflows. The flagged file and environment references are consistent with generating and copying project build outputs; no malicious behavior was identified.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Import exposes the command registry; file operations occur when the corresponding CLI workflow runs.
Impact
No malicious impact identified.
Mechanism
The inspected code builds and transforms project files. Searches found no network request or credential-exfiltration path in the package entry source.
AI rationale
The manifest has no install-time hook, and the exported functionality matches frontend CLI and build workflows. The flagged file and environment references are consistent with generating and copying project build outputs; no malicious behavior was identified.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest defines prepublish and packaging scripts, with no install, preinstall or postinstall hook.
- The module exports Zova CLI command families for init, refactor, tools and OpenAPI workflows.
- The build routine generates TypeScript outputs and copies them into project release paths.
Evidence against
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedpackage.jsonView file
•devDependencies registry_only=clean-package,rimraf
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkg31"prepublishOnly": "npm run tsc:publish",
"prepack": "clean-package",
"postpack": "clean-package restore"
},
"dependencies": {
"@babel/plugin-proposal-
Low
Suspicious Lifecycle Evidence
The manifest defines prepublish and packaging scripts, with no install, preinstall or postinstall hook.
package.jsonView on unpkg · L31dist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = zova-cli-set-front@1.2.106
matchedIdentity = npm:em92YS1jbGktc2V0LWZyb250:1.2.106
similarity = 0.896
summary = stored previous version shares package body but lacks this dangerous source file
High
Findings
1 Critical1 High1 Medium8 Low
CriticalManifest Confusionpackage.json
HighPrevious Version Dangerous Deltadist/index.js
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to zova-cli-set-front@1.2.121.
See all versions of zova-cli-set-front for other recorded verdicts.
- Review the evidence and your use of zova-cli-set-front@1.2.121 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.