registry / @livx.cc/appwrap / 0.42.3

@livx.cc/appwrap@0.42.3

Wrap any PWA into a native app with native capabilities (appwrap runtime + @livx.cc/native-kit).

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package is a user-invoked NativeScript/PWA wrapper CLI with broad but package-aligned build, device, CI scaffold, and native bridge capabilities.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs appwrap CLI commands such as init, sync, dev, build, deploy, publish, clean, or logs.

Impact

May write generated native project files, CI templates, app resources, and app-sandbox runtime data as part of documented wrapper functionality.

Mechanism

explicit scaffold/build/deploy CLI and native app bridge generation

Rationale

The suspicious primitives are consistent with an explicitly invoked mobile wrapper/build tool and runtime capability bridge, with no install-time execution or covert exfiltration/persistence found. CI/workflow and package-manager writes occur during user-run appwrap commands in the consumer project, not unconsented lifecycle mutation.

Evidence

package.jsonscripts/stage-assets.mjssrc/cli.tssrc/config.tsruntime/package.jsonruntime/app/shell/handlers-fs.tsruntime/app/shell/handlers-extended.tsruntime/app/shell/handlers-scanner.tsnative/native/fastlane/native/app/shell/config.tsnative/www-src/native/.gitignore.github/workflows/appwrap-release-ios.yml.github/workflows/appwrap-release-android.yml.github/workflows/appwrap-pr.yml

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for block

src/cli.ts uses execFileSync/spawn for ns, bun, adb, xcrun, fastlane, curl, and bunx commands.
src/cli.ts copyCiTemplates can write .github/workflows and native/fastlane during appwrap init.
src/cli.ts vendorBackendAssets fetches user-configured backendOrigin/vendorPaths with curl into generated www-src.
runtime/app/shell/handlers-fs.ts and handlers-extended.ts expose app-sandbox file, clipboard, scanner, secure-storage, and native capability bridge handlers.

Evidence against

package.json has no install/postinstall/preinstall lifecycle hooks; bin is user-invoked appwrap CLI.
scripts/stage-assets.mjs only stages bundled runtime/templates for packaging via prepack, not consumer install.
src/cli.ts command execution is tied to explicit CLI actions such as init, sync, dev, build, deploy, publish, clean, logs.
No evidence of credential harvesting, hardcoded exfiltration endpoint, persistence outside generated app/project files, or AI-agent control-surface writes.
runtime/package.json dependencies are NativeScript/runtime-aligned; dynamic require loads @nativescript/secure-storage for secure storage.
Network URLs are user-provided config/dev/server values or package repository metadata, not covert destinations.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 57 file(s), 594 KB of source, external domains: app.example.com, appwrap.local, www.apple.com

Source & flagged code

4 flagged

src/cli.tsView file

Lines 1-30typescript

1#!/usr/bin/env bun

2/**

3 * appwrap CLI v0 — scaffold a native wrapper around a built PWA.

4 *

5 * appwrap init [--config <path>] [--out native] # from the PWA project dir

6 * appwrap sync [--config <path>] [--out native] # re-copy PWA dist into the wrapper

7 *

8 * Config (TS preferred, JSON fallback) — probed in order: appwrap.config.ts → .js → appwrap.json.

9 * Shape: { id, name, version, entry?, backgroundColor?, statusBarStyle?, pwaDist }. See config.ts.

10 */

11import { execFileSync, spawn } from 'child_process';

12import { cpSync, existsSync, mkdirSync, openSync, closeSync, readdirSync, readFileSync, readSync, rmSync, statSync, writeFileSync, writeSync } from 'fs';

High

Child Process

Package source references child process execution.

src/cli.tsView on unpkg · L10

13import { networkInterfaces, tmpdir } from 'os';

14import { dirname, join, resolve } from 'path';

15import { pathToFileURL } from 'url';

16// PURE-DATA capability manifest (no NativeScript globals) — type-only import (erased at runtime);

17// the VALUES are loaded dynamically below from the resolved runtime so the CLI works both in the

18// monorepo and from a published tarball (where runtime/ is bundled at the package root).

19import type * as CapManifest from '../../../runtime/app/shell/capabilities.manifest';

20// Config shape lives in its own import-safe module so a `appwrap.config.ts` file can import the

21// type + `defineConfig` helper without pulling in (and running) the CLI dispatch.

22import type { AppwrapConfig } from './config';

23import { unknownConfigKeys } from './config';

24import {

25 androidScreenOrientation,

26 applyBuildNumberFlag,

27 iosOrientations,

28 mergeManifest,

29 resolveBuildNumber,

30 stampAndroidOrientation,

Lines 1799-1839typescript

1799 return candidates.find((d) => existsSync(join(d, 'platform-tools')) || existsSync(join(d, 'platforms')));

1800}

1801

1802/** Build the env for an `ns` invocation in `outDir` (auto-detect Android SDK, ensure bun-installed deps).

1803 * Shared by the blocking `runNs` (sim) and the non-blocking spawn in `dev` (device livesync). */

1804function prepareNsEnv(outDir:

•matchType = previous_version_dangerous_delta matchedPackage = @livx.cc/appwrap@0.42.2 matchedIdentity = npm:QGxpdnguY2MvYXBwd3JhcA:0.42.2 similarity = 0.981 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli.tsView on unpkg

runtime/app/shell/handlers-extended.tsView file

Lines 167-207typescript

167 bridge.register('clipboard.copy', ({ text }: { text: string }) => {

168 if (isIOS) {

169 UIPasteboard.generalPasteboard.string = String(text ?? '');

170 } else if

Source & flagged code

4 flagged · loading source

src/cli.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli.tsView on unpkg

10*/ L11: import { execFileSync, spawn } from 'child_process'; L12: import { cpSync, existsSync, mkdirSync, openSync, closeSync, readdirSync, readFileSync, readSync, rmSync, statSync, writeFileSync, writeSync } from 'fs';

High

Child Process

Package source references child process execution.

src/cli.tsView on unpkg · L10

1819if (!existsSync(join(outDir, 'node_modules'))) { L1820: console.log(`▶ bun install (cwd: ${outDir})`); L1821: execFileSync('bun', ['install'], { cwd: outDir, stdio: 'inherit', env }); L1822: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/cli.tsView on unpkg · L1819

runtime/app/shell/handlers-extended.tsView file

187// ── secure storage (Keychain/Keystore via @nativescript/secure-storage) ── L188: const secure = new (require('@nativescript/secure-storage').SecureStorage)(); L189: bridge.register('storage.secure.get', async ({ key }: { key: string }) =>

Medium

Dynamic Require

Package source references dynamic require/import behavior.

runtime/app/shell/handlers-extended.tsView on unpkg · L187

Findings

1 Critical3 High3 Medium4 Low

CriticalPrevious Version Dangerous Deltasrc/cli.ts

HighChild Processsrc/cli.ts

HighShell

HighRuntime Package Installsrc/cli.ts

MediumDynamic Requireruntime/app/shell/handlers-extended.ts

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

src/cli.tsView file

Lines 1-30typescript

1#!/usr/bin/env bun

2/**

3 * appwrap CLI v0 — scaffold a native wrapper around a built PWA.

4 *

5 * appwrap init [--config <path>] [--out native] # from the PWA project dir

6 * appwrap sync [--config <path>] [--out native] # re-copy PWA dist into the wrapper

7 *

8 * Config (TS preferred, JSON fallback) — probed in order: appwrap.config.ts → .js → appwrap.json.

9 * Shape: { id, name, version, entry?, backgroundColor?, statusBarStyle?, pwaDist }. See config.ts.

10 */

11import { execFileSync, spawn } from 'child_process';

12import { cpSync, existsSync, mkdirSync, openSync, closeSync, readdirSync, readFileSync, readSync, rmSync, statSync, writeFileSync, writeSync } from 'fs';

High

Child Process

Package source references child process execution.

src/cli.tsView on unpkg · L10

13import { networkInterfaces, tmpdir } from 'os';

14import { dirname, join, resolve } from 'path';

15import { pathToFileURL } from 'url';

16// PURE-DATA capability manifest (no NativeScript globals) — type-only import (erased at runtime);

17// the VALUES are loaded dynamically below from the resolved runtime so the CLI works both in the

18// monorepo and from a published tarball (where runtime/ is bundled at the package root).

19import type * as CapManifest from '../../../runtime/app/shell/capabilities.manifest';

20// Config shape lives in its own import-safe module so a `appwrap.config.ts` file can import the

21// type + `defineConfig` helper without pulling in (and running) the CLI dispatch.

22import type { AppwrapConfig } from './config';

23import { unknownConfigKeys } from './config';

24import {

25 androidScreenOrientation,

26 applyBuildNumberFlag,

27 iosOrientations,

28 mergeManifest,

29 resolveBuildNumber,

30 stampAndroidOrientation,

Lines 1799-1839typescript

1799 return candidates.find((d) => existsSync(join(d, 'platform-tools')) || existsSync(join(d, 'platforms')));

1800}

1801

1802/** Build the env for an `ns` invocation in `outDir` (auto-detect Android SDK, ensure bun-installed deps).

1803 * Shared by the blocking `runNs` (sim) and the non-blocking spawn in `dev` (device livesync). */

1804function prepareNsEnv(outDir:

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli.tsView on unpkg

runtime/app/shell/handlers-extended.tsView file

Lines 167-207typescript

167 bridge.register('clipboard.copy', ({ text }: { text: string }) => {

168 if (isIOS) {

169 UIPasteboard.generalPasteboard.string = String(text ?? '');

170 } else if