registry / @posthog/wizard / 2.36.0

@posthog/wizard@2.36.0

The PostHog wizard helps you to configure your project

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 41 file(s), 1.13 MB of source, external domains: 127.0.0.1, app.posthog.com, claude.ai, eu-assets.i.posthog.com, eu.i.posthog.com, eu.posthog.com, gateway.eu.posthog.com, gateway.us.posthog.com, github.com, hacker-news.firebaseio.com, host.docker.internal, internal-j.posthog.com, mcp.posthog.com, mcp.svelte.dev, news.ycombinator.com, oauth.posthog.com, posthog.com, status.claude.com, status.npmjs.org, us-assets.i.posthog.com, us.i.posthog.com, us.posthog.com, www.cloudflarestatus.com, www.githubstatus.com, www.posthogstatus.com

Source & flagged code

4 flagged

dist/start-tui-oGWfxdTd.jsView file

Lines 1-38javascript

1import { H as POSTHOG_TERMS_URL, I as POSTHOG_DOCS_URL, M as OAUTH_PORTS, N as OAUTH_TIMEOUT_MS, R as POSTHOG_ORG_AI_SETTINGS_URL, W as REMOTE_SKILLS_BASE_URL, X as WIZARD_TOOLS_MENU_FLAG_KEY, _ as SIGNUP_WIZARD_READINESS_CONFIG, d as relativeToInstallDir, j as Integration, l as WIZARD_LOG_FILE, m as setUI, s as logToFile, y as getBlockingServiceKeys, z as POSTHOG_PRIVACY_URL } from "./debug-BpWrz3hX.js";

2import { t as analytics } from "./analytics-Be_wRgxD.js";

3import { o as extractOAuthCode, t as getOrAskForProjectData } from "./setup-utils-BxdW2R0r.js";

4import { o as getUiHostFromHost } from "./urls-DpTCPWLD.js";

5import { t as ApiError } from "./api-C_R_ybiA.js";

6import { t as ADDITIONAL_FEATURE_LABELS } from "./wizard-session-CqihOtk3.js";

7import { i as wizardAbort } from "./wizard-abort-t41wO4Bh.js";

8import { A as coerceAuditChecks, D as AUDIT_CHECKS_KEY, E as AUDIT_CHECKS_FILE, _ as EVENT_PLAN_FILE, b as downloadSkill, j as getAuditChecks, k as AUDIT_SEVERITY_STYLE, x as fetchSkillMenu } from "./agent-interface-CPn9pZ8j.js";

9import { t as FRAMEWORK_REGISTRY } from "./registry-DFazVUSE.js";

10import { g as detectProjectsWithAgent, m as Icons, p as Colors, t as SETUP_REPORT_FILE } from "./posthog-integration-B6pTHVcn.js";

11import { C as STRIPE_SDKS, S as POSTHOG_SDKS, _ as SOURCE_MAPS_CONTEXT_KEYS, b as getDetectedWarehouseSources, d as Program, f as getProgramConfig, g as DISPLAY_NAME, h as AUTOMATABLE_VARIANTS, m as SELF_DRIVING_INTEGRATE_PATH_KEY, n as useKeyBindings, p as detectSelfDrivingIntegrationProjects, t as PickerMenu, x as getContentBlocks, y as fetchHealthIssues } from "./bin.js";

12import { t as WizardStore } from "./store-Di9OvMql.js";

13import { A as ConfirmationInput, C as TabContainer, D as LinkText, E as LogViewer, F as SplitView, M as useStdoutDimensions, N as ProgressList, O as extractUrls, P as LoadingBox, S as HNViewer, T as EventPlanViewer, _ as ServiceHealthList, a as useSkillEntry, b as LearnCard, c as AUDIT_AREA_SLIDES, d as McpSuggestedPromptsScreen, g as SEVERITY_ORDER, h as SEVERITY_LABEL, i as SkillSourceInfo, k as ModalOverlay, l as VisualBox, m as IssueTable, n

14import { t as ALL_FEATURE_VALUES } from "./defaults-UswXMiTx.js";

15import { a as getSupportedClients, c as removeMCPServer, i as getInstalledClients, o as getSupportedPluginClients, s as installPlugins, u as isPluginCapable } from "./add-mcp-server-to-clients-D5e3JbUC.js";

16import * as fs$1 from "fs";

17import path from "path";

18import { join as join$1 } from "node:path";

19import { spawn, spawnSync } from "node:child_process";

20import { Box, Text, render, useInput } from "ink";

High

Child Process

Package source references child process execution.

dist/start-tui-oGWfxdTd.jsView on unpkg · L18

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/start-tui-oGWfxdTd.jsView on unpkg · L12

21import { Fragment, createElement, useEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";

22import { Fragment as Fragment$1, jsx, jsxs } from "react/jsx-runtime";

23import { access, readdir, rm } from "node:fs/promises";

24import { Spinner, TextInput } from "@inkjs/ui";

25//#region src/ui/tui/ink-ui.ts

26const ANSI_RE = /\x1b\[[0-9;]*m/g;

27function stripAnsi(s) {

28 return s.replace(ANSI_RE, "");

29}

30var InkUI = class {

31 constructor(store) {

32 this.store = store;

33 }

34 intro(message) {

35 this.store.pushStatus(message);

36 }

37 outro(message) {

38 this.store.pushStatus(stripAnsi(message));

Long lines were clipped for display.

dist/generate-version.cjsView file

Lines 1-12javascript

1const fs = require('fs');

2const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/generate-version.cjsView on unpkg · L1

4const pkg = JSON.

dist/smoke-test-ci.shView file

•path = dist/smoke-test-ci.sh kind = build_helper sizeBytes = 5579 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/smoke-test-ci.shView on unpkg

Source & flagged code

4 flagged · loading source

dist/start-tui-oGWfxdTd.jsView file

18import { join as join$1 } from "node:path"; L19: import { spawn, spawnSync } from "node:child_process"; L20: import { Box, Text, render, useInput } from "ink";

High

Child Process

Package source references child process execution.

dist/start-tui-oGWfxdTd.jsView on unpkg · L18

12Cross-file remote execution chain: dist/start-tui-oGWfxdTd.js spawns dist/debug-BpWrz3hX.js; helper contains network access plus dynamic code execution. L12: import { t as WizardStore } from "./store-Di9OvMql.js"; L13: import { A as ConfirmationInput, C as TabContainer, D as LinkText, E as LogViewer, F as SplitView, M as useStdoutDimensions, N as ProgressList, O as extractUrls, P as LoadingBox, S... L14: import { t as ALL_FEATURE_VALUES } from "./defaults-UswXMiTx.js"; ... L18: import { join as join$1 } from "node:path"; L19: import { spawn, spawnSync } from "node:child_process"; L20: import { Box, Text, render, useInput } from "ink"; ... L461: message: "Failed to fetch health issues", L462: body: state.message, L463: docsUrl: POSTHOG_DOCS_URL ... L753: * full callback URL the browser was redirected to L754: * (`http://localhost:8239/callback?code=...`) or just the code. On submit we L755: * extract the code and resolve the in-flight OAuth flow; bad input shows inline

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/start-tui-oGWfxdTd.jsView on unpkg · L12

dist/generate-version.cjsView file

1const fs = require('fs'); L2: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/generate-version.cjsView on unpkg · L1

dist/smoke-test-ci.shView file

•path = dist/smoke-test-ci.sh kind = build_helper sizeBytes = 5579 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/smoke-test-ci.shView on unpkg

Findings

3 High5 Medium5 Low

HighChild Processdist/start-tui-oGWfxdTd.js

HighShell

HighCross File Remote Execution Contextdist/start-tui-oGWfxdTd.js

MediumDynamic Requiredist/generate-version.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/smoke-test-ci.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

4 flagged

dist/start-tui-oGWfxdTd.jsView file

Lines 1-38javascript

2import { t as analytics } from "./analytics-Be_wRgxD.js";

3import { o as extractOAuthCode, t as getOrAskForProjectData } from "./setup-utils-BxdW2R0r.js";

4import { o as getUiHostFromHost } from "./urls-DpTCPWLD.js";

5import { t as ApiError } from "./api-C_R_ybiA.js";

6import { t as ADDITIONAL_FEATURE_LABELS } from "./wizard-session-CqihOtk3.js";

7import { i as wizardAbort } from "./wizard-abort-t41wO4Bh.js";

9import { t as FRAMEWORK_REGISTRY } from "./registry-DFazVUSE.js";

10import { g as detectProjectsWithAgent, m as Icons, p as Colors, t as SETUP_REPORT_FILE } from "./posthog-integration-B6pTHVcn.js";

12import { t as WizardStore } from "./store-Di9OvMql.js";

14import { t as ALL_FEATURE_VALUES } from "./defaults-UswXMiTx.js";

16import * as fs$1 from "fs";

17import path from "path";

18import { join as join$1 } from "node:path";

19import { spawn, spawnSync } from "node:child_process";

20import { Box, Text, render, useInput } from "ink";

High

Child Process

Package source references child process execution.

dist/start-tui-oGWfxdTd.jsView on unpkg · L18

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/start-tui-oGWfxdTd.jsView on unpkg · L12

21import { Fragment, createElement, useEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";

22import { Fragment as Fragment$1, jsx, jsxs } from "react/jsx-runtime";

23import { access, readdir, rm } from "node:fs/promises";

24import { Spinner, TextInput } from "@inkjs/ui";

25//#region src/ui/tui/ink-ui.ts

26const ANSI_RE = /\x1b\[[0-9;]*m/g;

27function stripAnsi(s) {

28 return s.replace(ANSI_RE, "");

29}

30var InkUI = class {

31 constructor(store) {

32 this.store = store;

33 }

34 intro(message) {

35 this.store.pushStatus(message);

36 }

37 outro(message) {

38 this.store.pushStatus(stripAnsi(message));

Long lines were clipped for display.

dist/generate-version.cjsView file

Lines 1-12javascript

1const fs = require('fs');

2const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/generate-version.cjsView on unpkg · L1

4const pkg = JSON.

dist/smoke-test-ci.shView file

•path = dist/smoke-test-ci.sh kind = build_helper sizeBytes = 5579 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/smoke-test-ci.shView on unpkg