registry / @livx.cc/appwrap / 0.41.0

@livx.cc/appwrap@0.41.0

Wrap any PWA into a native app with native capabilities (appwrap runtime + @livx.cc/native-kit).

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The package is a PWA-to-native wrapper CLI whose filesystem writes, workflow scaffolding, package install, and device/build subprocesses are explicit command behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs appwrap init/sync/dev/build/deploy/publish/logs.

Impact

Creates or updates native wrapper output, optional CI templates, app bundle assets, and invokes local build/device tools.

Mechanism

User-invoked native wrapper generation and build/deploy orchestration

Rationale

Static inspection shows powerful CLI behavior, but it is consistent with the package's documented purpose and activated by explicit user commands rather than install/import-time execution. I found no hardcoded exfiltration endpoint, credential harvesting, destructive action outside generated/project paths, or unconsented AI-agent control-surface mutation.

Evidence

package.jsonsrc/cli.tssrc/config.tssrc/derive.tsruntime/app/shell/handlers-extended.tsruntime/app/shell/handlers-push.tsscripts/stage-assets.mjstemplates/ci/github/workflows/appwrap-release-ios.ymltemplates/ci/github/workflows/appwrap-release-android.ymlnative/native/.gitignorenative/.appwrap-version.github/workflows/appwrap-release-ios.yml.github/workflows/appwrap-release-android.yml.github/workflows/appwrap-pr.ymlappwrap.config.tsappwrap.config.jsappwrap.json

Network endpoints4

appwrap.local<lan-ip>:5173cfg.backendOrigin/cfg.vendorPathscfg.push.registrationUrl

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for block

src/cli.ts shells out to bun/ns/adb/xcrun/fastlane/bunx during user-invoked dev/build/deploy/publish commands.
src/cli.ts writes generated wrapper files and may scaffold .github/workflows during appwrap init.
src/cli.ts can curl cfg.backendOrigin/cfg.vendorPaths assets into the app bundle when configured.

Evidence against

package.json has no install/postinstall lifecycle hooks; prepack/postpack are publish-time packaging only.
src/cli.ts dispatch is gated by import.meta.main; config export import does not run CLI commands.
Shell/package-manager commands are aligned with native app scaffolding/build/deploy behavior and require explicit CLI commands.
Network URLs are user-supplied config/dev-server/push endpoints or local appwrap runtime origins, not hardcoded exfiltration endpoints.
No credential harvesting or hidden persistence found; signing env vars are passed to build tools and masked in logs.
runtime/app/shell/handlers-extended.ts dynamic require loads @nativescript/secure-storage for declared secure-storage capability.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 57 file(s), 550 KB of source, external domains: app.example.com, appwrap.local, schemas.android.com, www.apple.com

Source & flagged code

4 flagged

src/cli.tsView file

Lines 1-30typescript

1#!/usr/bin/env bun

2/**

3 * appwrap CLI v0 — scaffold a native wrapper around a built PWA.

4 *

5 * appwrap init [--config <path>] [--out native] # from the PWA project dir

6 * appwrap sync [--config <path>] [--out native] # re-copy PWA dist into the wrapper

7 *

8 * Config (TS preferred, JSON fallback) — probed in order: appwrap.config.ts → .js → appwrap.json.

9 * Shape: { id, name, version, entry?, backgroundColor?, statusBarStyle?, pwaDist }. See config.ts.

10 */

11import { execFileSync, spawn } from 'child_process';

12import { cpSync, existsSync, mkdirSync, openSync, closeSync, readdirSync, readFileSync, readSync, rmSync, statSync, writeFileSync, writeSync } from 'fs';

High

Child Process

Package source references child process execution.

src/cli.tsView on unpkg · L10

13import { networkInterfaces, tmpdir } from 'os';

14import { dirname, join, resolve } from 'path';

15import { pathToFileURL } from 'url';

16// PURE-DATA capability manifest (no NativeScript globals) — type-only import (erased at runtime);

17// the VALUES are loaded dynamically below from the resolved runtime so the CLI works both in the

18// monorepo and from a published tarball (where runtime/ is bundled at the package root).

19import type * as CapManifest from '../../../runtime/app/shell/capabilities.manifest';

20// Config shape lives in its own import-safe module so a `appwrap.config.ts` file can import the

21// type + `defineConfig` helper without pulling in (and running) the CLI dispatch.

22import type { AppwrapConfig } from './config';

23import { unknownConfigKeys } from './config';

24import {

25 androidScreenOrientation,

26 applyBuildNumberFlag,

27 iosOrientations,

28 mergeManifest,

29 resolveBuildNumber,

30 stampAndroidOrientation,

Lines 1412-1452typescript

1412 return candidates.find((d) => existsSync(join(d, 'platform-tools')) || existsSync(join(d, 'platforms')));

1413}

1414

1415/** Build the env for an `ns` invocation in `outDir` (auto-detect Android SDK, ensure bun-installed deps).

1416 * Shared by the blocking `runNs` (sim) and the non-blocking spawn in `dev` (device livesync). */

1417function prepareNsEnv(outDir:

•matchType = previous_version_dangerous_delta matchedPackage = @livx.cc/appwrap@0.40.0 matchedIdentity = npm:QGxpdnguY2MvYXBwd3JhcA:0.40.0 similarity = 0.942 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

src/cli.tsView on unpkg

runtime/app/shell/handlers-extended.tsView file

Lines 167-207typescript

167 bridge.register('clipboard.copy', ({ text }: { text: string }) => {

168 if (isIOS) {

169 UIPasteboard.generalPasteboard.string = String(text ?? '');

170 } else if

Source & flagged code

4 flagged · loading source

src/cli.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

src/cli.tsView on unpkg

10*/ L11: import { execFileSync, spawn } from 'child_process'; L12: import { cpSync, existsSync, mkdirSync, openSync, closeSync, readdirSync, readFileSync, readSync, rmSync, statSync, writeFileSync, writeSync } from 'fs';

High

Child Process

Package source references child process execution.

src/cli.tsView on unpkg · L10

1432if (!existsSync(join(outDir, 'node_modules'))) { L1433: console.log(`▶ bun install (cwd: ${outDir})`); L1434: execFileSync('bun', ['install'], { cwd: outDir, stdio: 'inherit', env }); L1435: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/cli.tsView on unpkg · L1432

runtime/app/shell/handlers-extended.tsView file

187// ── secure storage (Keychain/Keystore via @nativescript/secure-storage) ── L188: const secure = new (require('@nativescript/secure-storage').SecureStorage)(); L189: bridge.register('storage.secure.get', async ({ key }: { key: string }) =>

Medium

Dynamic Require

Package source references dynamic require/import behavior.

runtime/app/shell/handlers-extended.tsView on unpkg · L187

Findings

1 Critical3 High3 Medium4 Low

CriticalPrevious Version Dangerous Deltasrc/cli.ts

HighChild Processsrc/cli.ts

HighShell

HighRuntime Package Installsrc/cli.ts

MediumDynamic Requireruntime/app/shell/handlers-extended.ts

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

src/cli.tsView file

Lines 1-30typescript

1#!/usr/bin/env bun

2/**

3 * appwrap CLI v0 — scaffold a native wrapper around a built PWA.

4 *

5 * appwrap init [--config <path>] [--out native] # from the PWA project dir

6 * appwrap sync [--config <path>] [--out native] # re-copy PWA dist into the wrapper

7 *

8 * Config (TS preferred, JSON fallback) — probed in order: appwrap.config.ts → .js → appwrap.json.

9 * Shape: { id, name, version, entry?, backgroundColor?, statusBarStyle?, pwaDist }. See config.ts.

10 */

11import { execFileSync, spawn } from 'child_process';

12import { cpSync, existsSync, mkdirSync, openSync, closeSync, readdirSync, readFileSync, readSync, rmSync, statSync, writeFileSync, writeSync } from 'fs';

High

Child Process

Package source references child process execution.

src/cli.tsView on unpkg · L10

13import { networkInterfaces, tmpdir } from 'os';

14import { dirname, join, resolve } from 'path';

15import { pathToFileURL } from 'url';

16// PURE-DATA capability manifest (no NativeScript globals) — type-only import (erased at runtime);

17// the VALUES are loaded dynamically below from the resolved runtime so the CLI works both in the

18// monorepo and from a published tarball (where runtime/ is bundled at the package root).

19import type * as CapManifest from '../../../runtime/app/shell/capabilities.manifest';

20// Config shape lives in its own import-safe module so a `appwrap.config.ts` file can import the

21// type + `defineConfig` helper without pulling in (and running) the CLI dispatch.

22import type { AppwrapConfig } from './config';

23import { unknownConfigKeys } from './config';

24import {

25 androidScreenOrientation,

26 applyBuildNumberFlag,

27 iosOrientations,

28 mergeManifest,

29 resolveBuildNumber,

30 stampAndroidOrientation,

Lines 1412-1452typescript

1412 return candidates.find((d) => existsSync(join(d, 'platform-tools')) || existsSync(join(d, 'platforms')));

1413}

1414

1415/** Build the env for an `ns` invocation in `outDir` (auto-detect Android SDK, ensure bun-installed deps).

1416 * Shared by the blocking `runNs` (sim) and the non-blocking spawn in `dev` (device livesync). */

1417function prepareNsEnv(outDir:

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

src/cli.tsView on unpkg

runtime/app/shell/handlers-extended.tsView file

Lines 167-207typescript

167 bridge.register('clipboard.copy', ({ text }: { text: string }) => {

168 if (isIOS) {

169 UIPasteboard.generalPasteboard.string = String(text ?? '');

170 } else if