@co0ontty/wand@4.77.0: Suspicious npm security report (Warn)

Loading npm security reports…

@co0ontty/wand@4.77.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

19 flagged

dist/structured-codex-adapter.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { startStructuredCli } from "./structured-exec-pump.js";

High

Child Process

Package source references child process execution.

dist/structured-codex-adapter.jsView on unpkg · L1

3import { CodexProtocolReducer } from "./structured-codex-protocol.js";

4import { whichSync } from "./path-repair.js";

5import { thinkingEffortToCodexReasoningEffort, promptWithSystemFallback } from "./structured-provider-common.js";

6/** Build the stable CLI contract for a structured Codex turn. */

7export function buildCodexArgs(session) {

8 const args = ["exec", "--json", "--color", "never"];

9 const shouldBypass = session.autoApprovePermissions === true

10 || session.mode === "full-access"

11 || session.mode === "managed";

12 if (shouldBypass) {

13 args.push("--dangerously-bypass-approvals-and-sandbox");

14 }

15 else if (session.mode === "auto-edit" || session.mode === "agent" || session.mode === "agent-max") {

16 args.push("--sandbox", "workspace-write");

17 }

18 else {

19 args.push("--sandbox", "read-only");

20 }

21 args.push("--skip-git-repo-check");

dist/server-file-routes.jsView file

Lines 1-32javascript

1import crypto from "node:crypto";

2import { exec } from "node:child_process";

3import { createReadStream } from "node:fs";

4import { lstat, mkdir, readdir, readFile, rename, rm, stat, unlink, writeFile } from "node:fs/promises"

dist/web-ui/scripts.jsView file

Lines 1-33javascript

1import { createHash } from "node:crypto";

2import * as fs from "node:fs";

3import * as path from "node:path";

dist/tui/commands.jsView file

Lines 1-24javascript

1/**

2 * TUI 运维操作命令集合。

3 *

4 * 所有命令统一返回 CommandResult，UI 层负责把结果渲染到 toast / 弹窗 / 日志。

5 * 命令本身不直接写 stdout / stderr —— TUI 模式下 stderr 已经被 log-bus 劫持。

6 */

7import { spawn, spawnSync } from "node:child_process";

8import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, unlinkSync } from

dist/render-structured-host.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { existsSync, lstatSync, readFileSync, unlinkSync } from "node:fs";

3import net from "node:net";

4import path from "node:path"

browser-extension/src/background.jsView file

•A browser extension granted access to all pages captures login passwords and POSTs vault records to a package-defined external default service. browser-extension/manifest.json: "<all_urls>" "service_worker": "src/background.js", "content_scripts": [ "<all_urls>" browser-extension/shared/url-tools.mjs: export const DEFAULT_BASE_URL = "https://home.huniu.fun:8183"; if (!raw) return DEFAULT_BASE_URL; if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return DEFAULT_BASE_URL; return DEFAULT_BASE_URL; const parsed = new URL(raw.includes("://") ? raw : `https://${raw}`); browser-extension/src/background.js: return { login: await loginAndAttach(message.baseUrl, message.password) }; body: JSON.stringify(message.item) body: JSON.stringify(message.item) body: JSON.stringify({ secret: m

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

browser-extension/src/background.jsView on unpkg

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

browser-extension/src/background.js

dist/npm-update-utils.jsView file

Lines 1-33javascript

1/**

2 * npm 全局更新通用辅助。

3 *

4 * 共用于 server.ts 的 /api/update / performAutoUpdate，以及 TUI 的 installUpdate。

5 *

6 * 解决的核心问题：当 wand 进程正在运行（systemd/launchd/nohup/直接前台都算）时，

7 * `npm install -g @co0ontty/wand@latest` 会把旧包目录 rename 成 `.wand-XXXXXX` 备份。

8 * 如果安装中途失败，这个备份目录会留下，之后每次 npm install 都会因为目标 dest 已存在

9 * 报 `ENOTEMPTY: directory not empty, rename ...`。

10 *

11 * 我们的策略：安装前备份当前全局包，补齐 npm 子进程 PATH，清掉

dist/server.jsView file

Lines 1-25javascript

1import crypto from "node:crypto";

2import compression from "compression";

3import express from "express";

4import { existsSync, readFileSync } from "node:fs";

dist/native/linux-arm64/wand-structured-renderdView file

•path = dist/native/linux-arm64/wand-structured-renderd kind = native_binary sizeBytes = 725056 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/linux-arm64/wand-structured-renderdView on unpkg

dist/cert.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cert.js#virtual:normalized:round1View on unpkg

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.63.0 matchedPath = dist/cli.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.63.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

dist/cert.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.63.0 matchedPath = dist/cert.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.63.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cert.jsView on unpkg

dist/git-utils.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.63.0 matchedPath = dist/git-utils.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.63.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/git-utils.jsView on unpkg

dist/relaunch.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.63.0 matchedPath = dist/relaunch.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.63.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/relaunch.jsView on unpkg

dist/claude-pty-bridge.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.63.0 matchedPath = dist/claude-pty-bridge.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.63.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/claude-pty-bridge.jsView on unpkg

dist/render-host.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @co0ontty/wand@4.72.0 matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.72.0 similarity = 0.525 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/render-host.jsView on unpkg

Source & flagged code

19 flagged · loading source

dist/structured-codex-adapter.jsView file

1import { spawn } from "node:child_process"; L2: import { startStructuredCli } from "./structured-exec-pump.js";

High

Child Process

Package source references child process execution.

dist/structured-codex-adapter.jsView on unpkg · L1

dist/server-file-routes.jsView file

12import { parseBoundedInteger } from "./request-limits.js"; L13: const execAsync = promisify(exec); L14: const DIRECTORY_MAX_ITEMS = 200;

High

Shell

Package source references shell execution.

dist/server-file-routes.jsView on unpkg · L12

dist/web-ui/scripts.jsView file

13} L14: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L15: let _scriptCache = EMBEDDED_WEB_ASSETS.scriptsJs;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/web-ui/scripts.jsView on unpkg · L13

dist/tui/commands.jsView file

4Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/tui/commands.js L4: * 所有命令统一返回 CommandResult，UI 层负责把结果渲染到 toast / 弹窗 / 日志。 L5: * 命令本身不直接写 stdout / stderr —— TUI 模式下 stderr 已经被 log-bus 劫持。 L6: */ L7: import { spawn, spawnSync } from "node:child_process"; L8: import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, unlinkSync } from "node:fs"; ... L43: stdio: "inherit", L44: env: process.env, L45: }); ... L111: export function openInBrowser(url) { L112: const cmd = process.platform === "darwin" L113: ? "open" ... L137: ok: false,

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/tui/commands.jsView on unpkg · L4

4* 所有命令统一返回 CommandResult，UI 层负责把结果渲染到 toast / 弹窗 / 日志。 L5: * 命令本身不直接写 stdout / stderr —— TUI 模式下 stderr 已经被 log-bus 劫持。 L6: */ L7: import { spawn, spawnSync } from "node:child_process"; L8: import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, unlinkSync } from "node:fs"; ... L43: stdio: "inherit", L44: env: process.env, L45: }); ... L111: export function openInBrowser(url) { L112: const cmd = process.platform === "darwin" L113: ? "open" ... L137: ok: false,

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/tui/commands.jsView on unpkg · L4

dist/render-structured-host.jsView file

1import { spawn } from "node:child_process"; L2: import { existsSync, lstatSync, readFileSync, unlinkSync } from "node:fs"; L3: import net from "node:net"; L4: import path from "node:path"; ... L12: export function resolveStructuredRenderBinary(configPath) { L13: const explicit = process.env.WAND_STRUCTURED_RENDER_BIN?.trim(); L14: if (explicit) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/render-structured-host.jsView on unpkg · L1

browser-extension/src/background.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

browser-extension/src/background.jsView on unpkg

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

browser-extension/src/background.js

dist/npm-update-utils.jsView file

13Cross-file remote execution chain: dist/npm[redacted] spawns dist/web-ui/content/scripts.js; helper contains network access plus dynamic code execution. L13: */ L14: import { execFile, spawnSync } from "node:child_process"; L15: import { randomUUID } from "node:crypto"; ... L26: const PACKAGE_BASENAME = "wand"; L27: const DEFAULT_NPM_BIN = process.platform === "win32" ? "npm.cmd" : "npm"; L28: const COMMON_UNIX_PATHS = ["/usr/local/sbin", "/usr/local/bin", "/usr/sbin", "/usr/bin", "/sbin", "/bin"]; ... L32: function npmBin() { L33: return process.env.WAND_NPM_BIN || DEFAULT_NPM_BIN; L34: } ... L78: try { L79: const { stdout } = await execFileAsync(npmBin(), ["view", getInstallSpecForChannel(channel), "version"], { timeout: timeoutMs, env: getChildEnv(), maxBuffer: INSTALL_MAX_BUFFER }); L8

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/npm-update-utils.jsView on unpkg · L13

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.63.0 matchedPath = dist/npm[redacted] matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.63.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/npm-update-utils.jsView on unpkg

dist/server.jsView file

5Detached bundled service listener: dist/server.js launches a Node helper and exposes a broad-bound HTTP listener. L5: import { stat } from "node:fs/promises"; L6: import { createServer as createHttpServer } from "node:http"; L7: import { createServer as createHttpsServer } from "node:https"; L8: import { spawn } from "node:child_process"; L9: import path from "node:path"; ... L69: // ── Package info ── L70: const PKG_JSON = JSON.parse(readFileSync(path.join(RUNTIME_ROOT_DIR, "package.json"), "utf8")); L71: const PKG_NAME = PKG_JSON.name; ... L231: } L232: process.stderr.write(`\n✗ [wand] ${label}：${message}\n`); L233: if (suggestion) ... L268: // 之后用户切 node 版本 / 重装 wand / 把 claude 装到新位置都不会更新 unit，

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/server.jsView on unpkg · L5

dist/native/linux-arm64/wand-structured-renderdView file

•path = dist/native/linux-arm64/wand-structured-renderd kind = native_binary sizeBytes = 725056 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/linux-arm64/wand-structured-renderdView on unpkg

dist/cert.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cert.js#virtual:normalized:round1View on unpkg

dist/cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

dist/cert.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cert.jsView on unpkg

dist/git-utils.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/git-utils.jsView on unpkg

dist/relaunch.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/relaunch.jsView on unpkg

dist/claude-pty-bridge.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/claude-pty-bridge.jsView on unpkg

dist/render-host.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/render-host.jsView on unpkg

Source & flagged code

19 flagged

dist/structured-codex-adapter.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { startStructuredCli } from "./structured-exec-pump.js";

High

Child Process

Package source references child process execution.

dist/structured-codex-adapter.jsView on unpkg · L1

3import { CodexProtocolReducer } from "./structured-codex-protocol.js";

4import { whichSync } from "./path-repair.js";

5import { thinkingEffortToCodexReasoningEffort, promptWithSystemFallback } from "./structured-provider-common.js";

6/** Build the stable CLI contract for a structured Codex turn. */

7export function buildCodexArgs(session) {

8 const args = ["exec", "--json", "--color", "never"];

9 const shouldBypass = session.autoApprovePermissions === true

10 || session.mode === "full-access"

11 || session.mode === "managed";

12 if (shouldBypass) {

13 args.push("--dangerously-bypass-approvals-and-sandbox");

14 }

15 else if (session.mode === "auto-edit" || session.mode === "agent" || session.mode === "agent-max") {

16 args.push("--sandbox", "workspace-write");

17 }

18 else {

19 args.push("--sandbox", "read-only");

20 }

21 args.push("--skip-git-repo-check");

dist/server-file-routes.jsView file

Lines 1-32javascript

1import crypto from "node:crypto";

2import { exec } from "node:child_process";

3import { createReadStream } from "node:fs";

4import { lstat, mkdir, readdir, readFile, rename, rm, stat, unlink, writeFile } from "node:fs/promises"

dist/web-ui/scripts.jsView file

Lines 1-33javascript

1import { createHash } from "node:crypto";

2import * as fs from "node:fs";

3import * as path from "node:path";

dist/tui/commands.jsView file

Lines 1-24javascript

1/**

2 * TUI 运维操作命令集合。

3 *

4 * 所有命令统一返回 CommandResult，UI 层负责把结果渲染到 toast / 弹窗 / 日志。

5 * 命令本身不直接写 stdout / stderr —— TUI 模式下 stderr 已经被 log-bus 劫持。

6 */

7import { spawn, spawnSync } from "node:child_process";

8import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, unlinkSync } from

dist/render-structured-host.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { existsSync, lstatSync, readFileSync, unlinkSync } from "node:fs";

3import net from "node:net";

4import path from "node:path"

browser-extension/src/background.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

browser-extension/src/background.jsView on unpkg

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

browser-extension/src/background.js

dist/npm-update-utils.jsView file

Lines 1-33javascript

1/**

2 * npm 全局更新通用辅助。

3 *

4 * 共用于 server.ts 的 /api/update / performAutoUpdate，以及 TUI 的 installUpdate。

5 *

6 * 解决的核心问题：当 wand 进程正在运行（systemd/launchd/nohup/直接前台都算）时，

7 * `npm install -g @co0ontty/wand@latest` 会把旧包目录 rename 成 `.wand-XXXXXX` 备份。

8 * 如果安装中途失败，这个备份目录会留下，之后每次 npm install 都会因为目标 dest 已存在

9 * 报 `ENOTEMPTY: directory not empty, rename ...`。

10 *

11 * 我们的策略：安装前备份当前全局包，补齐 npm 子进程 PATH，清掉

dist/server.jsView file

Lines 1-25javascript

1import crypto from "node:crypto";

2import compression from "compression";

3import express from "express";

4import { existsSync, readFileSync } from "node:fs";

dist/native/linux-arm64/wand-structured-renderdView file

•path = dist/native/linux-arm64/wand-structured-renderd kind = native_binary sizeBytes = 725056 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/linux-arm64/wand-structured-renderdView on unpkg

dist/cert.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cert.js#virtual:normalized:round1View on unpkg

dist/cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

dist/cert.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cert.jsView on unpkg

dist/git-utils.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/git-utils.jsView on unpkg

dist/relaunch.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/relaunch.jsView on unpkg

dist/claude-pty-bridge.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/claude-pty-bridge.jsView on unpkg

dist/render-host.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/render-host.jsView on unpkg

@co0ontty/wand@4.77.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code