@co0ontty/wand@4.47.0: Suspicious npm security report (Warn)

Loading npm security reports…

@co0ontty/wand@4.47.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

17 flagged

dist/config.jsView file

Lines 36-76javascript

36 "commitModel",

37 "commitAiSource",

38 "systemAi",

39 "defaultThinkingEffort",

40 "structuredRunner",

41 "language",

42 "cardDefaults",

43 "inheritEnv",

44];

45const PREFERENCE_KEY_SET = new Set(PREFERENCE_KEYS);

46function preferenceStorageKey(key) {

47 return `pref:${key}`;

48}

49export function isPreferenceKey(key) {

50 return PREFERENCE_KEY_SET.has(key);

51}

52export const defaultConfig = () => ({

53 host: "127.0.0.1",

54 port: 8443,

55 https: false,

56 password: "change-me",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/config.jsView on unpkg · L56

57 defaultProvider: "claude",

58 defaultSessionKind: "structured",

59 // 非 root 启动时才有资格用 Claude 的 permission-bypass（root 会被 Claude CLI 拒绝），

60 // 所以这种环境下把默认执行模式抬到「托管」——开箱即得自动确认权限的全自主体验。

61 // root 启动则保守回落到「default」（托管在 root 下也只能降级成 acceptEdits）。

62 // 注意：defaultMode 是偏好字段，只存 SQLite、不写 config.json（见 stripPreferenceFields），

63 // 这里仅作为「用户从未在设置里显式选过模式」时的回落值——显式选择始终优先。

64 defaultMode: isRunningAsRoot() ? "default" : "managed",

65 shell: process.env.SHELL || "/bin/bash",

66 defaultCwd: process.cwd(),

67 startupCommands: [],

68 allowedCommandPrefixes: [],

69 shortcutLogMaxBytes: 10 * 1024 * 1024,

70 language: "",

71 android: defaultAndroidApkConfig(),

72 macos: defaultMacosDmgConfig(),

73 ios: defaultIosIpaConfig(),

74 cardDefaults: defaultCardExpandDefaults(),

75 defaultModel: "",

76 defaultCodexModel: "",

dist/structured-codex-adapter.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { startStructuredCli } from "./structured-exec-pump.js";

High

Child Process

Package source references child process execution.

dist/structured-codex-adapter.jsView on unpkg · L1

3import { CodexProtocolReducer } from "./structured-codex-protocol.js";

dist/git-utils.jsView file

Lines 14-54javascript

14 GIT_ASKPASS: "true",

15 GCM_INTERACTIVE: "never",

16 SSH_ASKPASS_REQUIRE: "never",

17 GIT_EDITOR: "true",

18 GIT_SEQUENCE_EDITOR:

dist/tui/layout.jsView file

Lines 1-22javascript

1import { createRequire } from "node:module";

2import { stripAnsi } from "../pty-text-utils.js";

3const require = createRequire(import.meta.url);

dist/password-manager.jsView file

Lines 1-21javascript

1import crypto from "node:crypto";

2export const DEFAULT_BROWSER_EXTENSION_BASE_URL = "https://home.huniu.fun:8183";

3export const DEFAULT_PASSWORD_VAULT_ID = "personal"

dist/tui/commands.jsView file

Lines 1-24javascript

1/**

2 * TUI 运维操作命令集合。

3 *

4 * 所有命令统一返回 CommandResult，UI 层负责把结果渲染到 toast / 弹窗 / 日志。

5 * 命令本身不直接写 stdout / stderr —— TUI 模式下 stderr 已经被 log-bus 劫持。

6 */

7import { spawn, spawnSync } from "node:child_process";

8import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, unlinkSync } from

browser-extension/src/background.jsView file

•A browser extension granted access to all pages captures login passwords and POSTs vault records to a package-defined external default service. browser-extension/manifest.json: "<all_urls>" "service_worker": "src/background.js", "content_scripts": [ "<all_urls>" browser-extension/shared/url-tools.mjs: export const DEFAULT_BASE_URL = "https://home.huniu.fun:8183"; if (!raw) return DEFAULT_BASE_URL; if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return DEFAULT_BASE_URL; return DEFAULT_BASE_URL; const parsed = new URL(raw.includes("://") ? raw : `https://${raw}`); browser-extension/src/background.js: return { login: await loginAndAttach(message.baseUrl, message.password) }; body: JSON.stringify(message.item) body: JSON.stringify(message.item) body: JSON.stringify({ secret: m

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

browser-extension/src/background.jsView on unpkg

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

browser-extension/src/background.js

dist/server.jsView file

Lines 1-25javascript

1import crypto from "node:crypto";

2import compression from "compression";

3import express from "express";

4import { existsSync, readFileSync } from "node:fs";

dist/web-ui/embedded-assets.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/web-ui/embedded-assets.jsView on unpkg

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.46.0 matchedPath = dist/cli.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.46.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

dist/npm-update-utils.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.46.0 matchedPath = dist/npm[redacted] matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.46.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/npm-update-utils.jsView on unpkg

dist/path-repair.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.46.0 matchedPath = dist/path-repair.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.46.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/path-repair.jsView on unpkg

dist/provider-cli-updater.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.46.0 matchedPath = dist/provider-cli-updater.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.46.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/provider-cli-updater.jsView on unpkg

Source & flagged code

17 flagged · loading source

dist/config.jsView file

56patternName = generic_password severity = medium line = 56 matchedText = password...me",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/config.jsView on unpkg · L56

dist/structured-codex-adapter.jsView file

1import { spawn } from "node:child_process"; L2: import { startStructuredCli } from "./structured-exec-pump.js";

High

Child Process

Package source references child process execution.

dist/structured-codex-adapter.jsView on unpkg · L1

dist/git-utils.jsView file

34} L35: function gitExecAsyncOptions(cwd, opts) { L36: return {

High

Shell

Package source references shell execution.

dist/git-utils.jsView on unpkg · L34

dist/tui/layout.jsView file

2import { stripAnsi } from "../pty-text-utils.js"; L3: const require = createRequire(import.meta.url); L4: // neo-blessed 是 CJS，没有匹配 @types/blessed 的 default export，统一当 any 用。

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tui/layout.jsView on unpkg · L2

dist/password-manager.jsView file

1import crypto from "node:crypto"; L2: export const DEFAULT_BROWSER_EXTENSION_BASE_URL = "https://home.huniu.fun:8183"; L3: export const DEFAULT_PASSWORD_VAULT_ID = "personal"; ... L255: const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]); L256: return `${VAULT_CIPHER_PREFIX}${iv.toString("base64url")}.${cipher.getAuthTag().toString("base64url")}.${encrypted.toString("base64url")}`; L257: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/password-manager.jsView on unpkg · L1

dist/tui/commands.jsView file

4Detached bundled service listener: dist/tui/commands.js spawns dist/server.js; helper exposes a broad-bound HTTP listener. L4: * 所有命令统一返回 CommandResult，UI 层负责把结果渲染到 toast / 弹窗 / 日志。 L5: * 命令本身不直接写 stdout / stderr —— TUI 模式下 stderr 已经被 log-bus 劫持。 L6: */ L7: import { spawn, spawnSync } from "node:child_process"; L8: import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, unlinkSync } from "node:fs"; ... L39: stdio: "inherit", L40: env: process.env, L41: }); ... L107: export function openInBrowser(url) { L108: const cmd = process.platform === "darwin" L109: ? "open" ... L133: ok: false,

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/tui/commands.jsView on unpkg · L4

4Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/tui/commands.js L4: * 所有命令统一返回 CommandResult，UI 层负责把结果渲染到 toast / 弹窗 / 日志。 L5: * 命令本身不直接写 stdout / stderr —— TUI 模式下 stderr 已经被 log-bus 劫持。 L6: */ L7: import { spawn, spawnSync } from "node:child_process"; L8: import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, unlinkSync } from "node:fs"; ... L39: stdio: "inherit", L40: env: process.env, L41: }); ... L107: export function openInBrowser(url) { L108: const cmd = process.platform === "darwin" L109: ? "open" ... L133: ok: false,

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/tui/commands.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.46.0 matchedPath = dist/tui/commands.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.46.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

browser-extension/src/background.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

browser-extension/src/background.jsView on unpkg

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

browser-extension/src/background.js

dist/server.jsView file

5Cross-file remote execution chain: dist/server.js spawns dist/web-ui/content/vendor/xterm/xterm.bundle.js; helper contains network access plus dynamic code execution. L5: import { stat } from "node:fs/promises"; L6: import { createServer as createHttpServer } from "node:http"; L7: import { createServer as createHttpsServer } from "node:https"; L8: import { spawn } from "node:child_process"; L9: import os from "node:os"; ... L56: // ── Package info ── L57: const PKG_JSON = JSON.parse(readFileSync(path.join(RUNTIME_ROOT_DIR, "package.json"), "utf8")); L58: const PKG_NAME = PKG_JSON.name; ... L100: function isExternalAvatarSource(value) { L101: return /^(https?:|data:)/i.test(value); L102: } ... L371: const candidates = [];

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/server.jsView on unpkg · L5

dist/web-ui/embedded-assets.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/web-ui/embedded-assets.jsView on unpkg

dist/cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

dist/npm-update-utils.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/npm-update-utils.jsView on unpkg

dist/path-repair.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/path-repair.jsView on unpkg

dist/provider-cli-updater.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/provider-cli-updater.jsView on unpkg

Source & flagged code

17 flagged

dist/config.jsView file

Lines 36-76javascript

36 "commitModel",

37 "commitAiSource",

38 "systemAi",

39 "defaultThinkingEffort",

40 "structuredRunner",

41 "language",

42 "cardDefaults",

43 "inheritEnv",

44];

45const PREFERENCE_KEY_SET = new Set(PREFERENCE_KEYS);

46function preferenceStorageKey(key) {

47 return `pref:${key}`;

48}

49export function isPreferenceKey(key) {

50 return PREFERENCE_KEY_SET.has(key);

51}

52export const defaultConfig = () => ({

53 host: "127.0.0.1",

54 port: 8443,

55 https: false,

56 password: "change-me",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/config.jsView on unpkg · L56

57 defaultProvider: "claude",

58 defaultSessionKind: "structured",

59 // 非 root 启动时才有资格用 Claude 的 permission-bypass（root 会被 Claude CLI 拒绝），

60 // 所以这种环境下把默认执行模式抬到「托管」——开箱即得自动确认权限的全自主体验。

61 // root 启动则保守回落到「default」（托管在 root 下也只能降级成 acceptEdits）。

62 // 注意：defaultMode 是偏好字段，只存 SQLite、不写 config.json（见 stripPreferenceFields），

63 // 这里仅作为「用户从未在设置里显式选过模式」时的回落值——显式选择始终优先。

64 defaultMode: isRunningAsRoot() ? "default" : "managed",

65 shell: process.env.SHELL || "/bin/bash",

66 defaultCwd: process.cwd(),

67 startupCommands: [],

68 allowedCommandPrefixes: [],

69 shortcutLogMaxBytes: 10 * 1024 * 1024,

70 language: "",

71 android: defaultAndroidApkConfig(),

72 macos: defaultMacosDmgConfig(),

73 ios: defaultIosIpaConfig(),

74 cardDefaults: defaultCardExpandDefaults(),

75 defaultModel: "",

76 defaultCodexModel: "",

dist/structured-codex-adapter.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { startStructuredCli } from "./structured-exec-pump.js";

High

Child Process

Package source references child process execution.

dist/structured-codex-adapter.jsView on unpkg · L1

3import { CodexProtocolReducer } from "./structured-codex-protocol.js";

dist/git-utils.jsView file

Lines 14-54javascript

14 GIT_ASKPASS: "true",

15 GCM_INTERACTIVE: "never",

16 SSH_ASKPASS_REQUIRE: "never",

17 GIT_EDITOR: "true",

18 GIT_SEQUENCE_EDITOR:

dist/tui/layout.jsView file

Lines 1-22javascript

1import { createRequire } from "node:module";

2import { stripAnsi } from "../pty-text-utils.js";

3const require = createRequire(import.meta.url);

dist/password-manager.jsView file

Lines 1-21javascript

1import crypto from "node:crypto";

2export const DEFAULT_BROWSER_EXTENSION_BASE_URL = "https://home.huniu.fun:8183";

3export const DEFAULT_PASSWORD_VAULT_ID = "personal"

dist/tui/commands.jsView file

Lines 1-24javascript

1/**

2 * TUI 运维操作命令集合。

3 *

4 * 所有命令统一返回 CommandResult，UI 层负责把结果渲染到 toast / 弹窗 / 日志。

5 * 命令本身不直接写 stdout / stderr —— TUI 模式下 stderr 已经被 log-bus 劫持。

6 */

7import { spawn, spawnSync } from "node:child_process";

8import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, unlinkSync } from

browser-extension/src/background.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

browser-extension/src/background.jsView on unpkg

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

browser-extension/src/background.js

dist/server.jsView file

Lines 1-25javascript

1import crypto from "node:crypto";

2import compression from "compression";

3import express from "express";

4import { existsSync, readFileSync } from "node:fs";

dist/web-ui/embedded-assets.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/web-ui/embedded-assets.jsView on unpkg

dist/cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

dist/npm-update-utils.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/npm-update-utils.jsView on unpkg

dist/path-repair.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/path-repair.jsView on unpkg

dist/provider-cli-updater.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/provider-cli-updater.jsView on unpkg

@co0ontty/wand@4.47.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code