registry / @posthog/wizard / 2.37.0

@posthog/wizard@2.37.0

⚠ Under review

The PostHog wizard helps you to configure your project

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 41 file(s), 1.13 MB of source, external domains: 127.0.0.1, app.posthog.com, claude.ai, eu-assets.i.posthog.com, eu.i.posthog.com, eu.posthog.com, gateway.eu.posthog.com, gateway.us.posthog.com, github.com, hacker-news.firebaseio.com, host.docker.internal, internal-j.posthog.com, mcp.posthog.com, mcp.svelte.dev, news.ycombinator.com, oauth.posthog.com, posthog.com, status.claude.com, status.npmjs.org, us-assets.i.posthog.com, us.i.posthog.com, us.posthog.com, www.cloudflarestatus.com, www.githubstatus.com, www.posthogstatus.com

Source & flagged code

5 flagged

dist/setup-utils-CR8X8Fmf.jsView file

Lines 1-33javascript

1import { t as __exportAll } from "./rolldown-runtime-B_-DWIq7.js";

2import { A as ISSUES_URL, E as DEFAULT_HOST_URL, F as POSTHOG_DEV_CLIENT_ID, K as WIZARD_OAUTH_SCOPES, M as OAUTH_PORTS, N as OAUTH_TIMEOUT_MS, O as DUMMY_PROJECT_API_KEY, V as POSTHOG_PROXY_CLIENT_ID, Z as WIZARD_USER_AGENT, p as getUI, s as logToFile } from "./debug-CZwmzyDx.js";

3import { t as analytics } from "./analytics-Du8Z_3oX.js";

4import { i as withUtm, n as openTrackedLink, t as withProgress } from "./telemetry-DJNpvkYP.js";

5import { a as getOAuthUrl, s as resolveBaseUrl } from "./urls-B1a2v93j.js";

6import { t as HostResolution } from "./host-resolution-DrOzdKdY.js";

7import { t as provisionNewAccount } from "./provisioning-PosLaOt4.js";

8import { a as fetchUserData, r as fetchProjectData } from "./api-BqKMQVhj.js";

9import { i as wizardAbort } from "./wizard-abort-BG8VNOI9.js";

10import { major, minVersion } from "semver";

11import * as fs$2 from "fs";

12import * as path$1 from "path";

13import { basename, join as join$1 } from "node:path";

14import * as childProcess from "node:child_process";

15import { execSync } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/setup-utils-CR8X8Fmf.jsView on unpkg · L13

16import * as fs$1 from "node:fs";

17import axios from "axios";

18import * as crypto from "node:crypto";

19import * as http from "node:http";

20import { z } from "zod";

21//#region src/utils/package-manager.ts

22function hasLockfile(installDir, file) {

23 return fs$2.existsSync(path$1.join(installDir, file));

24}

25function lockfileHeaderContains(installDir, file, needle) {

26 try {

27 return fs$2.readFileSync(path$1.join(installDir, file), "utf-8").slice(0, 500).includes(needle);

28 } catch {

29 return false;

30 }

31}

32async function writeOverride(slot, pkgName, pkgVersion, { installDir }) {

33 const pkg = await getPackageDotJson({ installDir });

dist/generate-version.cjsView file

Lines 1-12javascript

1const fs = require('fs');

2const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/generate-version.cjsView on unpkg · L1

4const pkg = JSON.

dist/bin.jsView file

Lines 4-44javascript

4import { r as setEntryCommand } from "./telemetry-DJNpvkYP.js";

5import { n as isUsingTypeScript } from "./setup-utils-CR8X8Fmf.js";

6import { o as getUiHostFromHost } from "./urls-B1a2v93j.js";

7import { t as HostResolution } from "./host-resolution-DrOzdKdY.js";

dist/smoke-test-ci.shView file

•path = dist/smoke-test-ci.sh kind = build_helper sizeBytes = 5579 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/smoke-test-ci.shView on unpkg

dist/agent-interface-D8jnkEnB.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @posthog/wizard@2.36.0 matchedIdentity = npm:QHBvc3Rob2cvd2l6YXJk:2.36.0 similarity = 0.927 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/agent-interface-D8jnkEnB.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/setup-utils-CR8X8Fmf.jsView file

13import { basename, join as join$1 } from "node:path"; L14: import * as childProcess from "node:child_process"; L15: import { execSync } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/setup-utils-CR8X8Fmf.jsView on unpkg · L13

dist/generate-version.cjsView file

1const fs = require('fs'); L2: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/generate-version.cjsView on unpkg · L1

dist/bin.jsView file

24Cross-file remote execution chain: dist/bin.js spawns dist/debug-CZwmzyDx.js; helper contains network access plus dynamic code execution. L24: import * as path$1 from "node:path"; L25: import { spawnSync } from "node:child_process"; L26: import * as fs$1 from "node:fs"; L27: import axios from "axios"; L28: import { z } from "zod"; ... L169: const text = msg || err && err.message || "Invalid arguments"; L170: process.stderr.write(`\n\x1b[1;91m✖ ${text}\x1b[0m\n Run \`wizard --help\` to see available commands and options.\n\n`); L171: process.exit(1); ... L186: const argvHasCI = process.argv.slice(2).some((a) => a === "--ci" || a === "--no-ci" || a.startsWith("--ci=")); L187: const envHasCI = process.env.POSTHOG_WIZARD_CI != null && process.env.POSTHOG_WIZARD_CI !== ""; L188: if (argvHasCI || envHasCI) { ... L337: /**

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin.jsView on unpkg · L24

dist/smoke-test-ci.shView file

•path = dist/smoke-test-ci.sh kind = build_helper sizeBytes = 5579 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/smoke-test-ci.shView on unpkg

dist/agent-interface-D8jnkEnB.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/agent-interface-D8jnkEnB.jsView on unpkg

Findings

1 Critical3 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/agent-interface-D8jnkEnB.js

HighChild Processdist/setup-utils-CR8X8Fmf.js

HighShell

HighCross File Remote Execution Contextdist/bin.js

MediumDynamic Requiredist/generate-version.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/smoke-test-ci.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

5 flagged

dist/setup-utils-CR8X8Fmf.jsView file

Lines 1-33javascript

1import { t as __exportAll } from "./rolldown-runtime-B_-DWIq7.js";

3import { t as analytics } from "./analytics-Du8Z_3oX.js";

4import { i as withUtm, n as openTrackedLink, t as withProgress } from "./telemetry-DJNpvkYP.js";

5import { a as getOAuthUrl, s as resolveBaseUrl } from "./urls-B1a2v93j.js";

6import { t as HostResolution } from "./host-resolution-DrOzdKdY.js";

7import { t as provisionNewAccount } from "./provisioning-PosLaOt4.js";

8import { a as fetchUserData, r as fetchProjectData } from "./api-BqKMQVhj.js";

9import { i as wizardAbort } from "./wizard-abort-BG8VNOI9.js";

10import { major, minVersion } from "semver";

11import * as fs$2 from "fs";

12import * as path$1 from "path";

13import { basename, join as join$1 } from "node:path";

14import * as childProcess from "node:child_process";

15import { execSync } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/setup-utils-CR8X8Fmf.jsView on unpkg · L13

16import * as fs$1 from "node:fs";

17import axios from "axios";

18import * as crypto from "node:crypto";

19import * as http from "node:http";

20import { z } from "zod";

21//#region src/utils/package-manager.ts

22function hasLockfile(installDir, file) {

23 return fs$2.existsSync(path$1.join(installDir, file));

24}

25function lockfileHeaderContains(installDir, file, needle) {

26 try {

27 return fs$2.readFileSync(path$1.join(installDir, file), "utf-8").slice(0, 500).includes(needle);

28 } catch {

29 return false;

30 }

31}

32async function writeOverride(slot, pkgName, pkgVersion, { installDir }) {

33 const pkg = await getPackageDotJson({ installDir });

dist/generate-version.cjsView file

Lines 1-12javascript

1const fs = require('fs');

2const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/generate-version.cjsView on unpkg · L1

4const pkg = JSON.

dist/bin.jsView file

Lines 4-44javascript

4import { r as setEntryCommand } from "./telemetry-DJNpvkYP.js";

5import { n as isUsingTypeScript } from "./setup-utils-CR8X8Fmf.js";

6import { o as getUiHostFromHost } from "./urls-B1a2v93j.js";

7import { t as HostResolution } from "./host-resolution-DrOzdKdY.js";

dist/smoke-test-ci.shView file

•path = dist/smoke-test-ci.sh kind = build_helper sizeBytes = 5579 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/smoke-test-ci.shView on unpkg

dist/agent-interface-D8jnkEnB.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/agent-interface-D8jnkEnB.jsView on unpkg