registry / @posthog/wizard / 2.38.1

@posthog/wizard@2.38.1

⚠ Under review

The PostHog wizard helps you to configure your project

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 48 file(s), 1.23 MB of source, external domains: 127.0.0.1, app.posthog.com, claude.ai, eu-assets.i.posthog.com, eu.i.posthog.com, eu.posthog.com, gateway.eu.posthog.com, gateway.us.posthog.com, github.com, hacker-news.firebaseio.com, host.docker.internal, internal-j.posthog.com, mcp.posthog.com, mcp.svelte.dev, news.ycombinator.com, oauth.posthog.com, posthog.com, status.claude.com, status.npmjs.org, us-assets.i.posthog.com, us.i.posthog.com, us.posthog.com, www.cloudflarestatus.com, www.githubstatus.com, www.posthogstatus.com

Source & flagged code

6 flagged

dist/package-manager-C5VVQHQ-.jsView file

Lines 1-21javascript

1import { s as detectAllPackageManagers } from "./setup-utils-v9I6PQyP.js";

2import { execSync } from "node:child_process";

3//#region src/frameworks/python/utils.ts

High

Child Process

Package source references child process execution.

dist/package-manager-C5VVQHQ-.jsView on unpkg · L1

4/**

5* Get the installed Python version

6*/

7function getPythonVersion(options) {

8 try {

9 return execSync("python --version || python3 --version", {

10 cwd: options.installDir,

11 encoding: "utf-8"

12 }).trim().replace("Python ", "");

13 } catch {

14 return;

15 }

16}

17/**

18* Bucket Python version for analytics (e.g., "3.11.x" -> "3.11")

19*/

20function getPythonVersionBucket(version) {

21 const match = version.match(/^(\d+\.\d+)/);

dist/wizard-tools-C8nVWLeI.jsView file

Lines 279-319javascript

279 }

280 enqueue(input) {

281 const task = {

282 id: randomUUID(),

283 type: input.type,

284 label: input.label,

285 status: TaskStatus.Pending,

286 dependsOn: input.dependsOn ?? [],

287 inputs: input.inputs

dist/bin.jsView file

Lines 5-45javascript

5import { n as isUsingTypeScript } from "./setup-utils-v9I6PQyP.js";

6import { o as getUiHostFromHost } from "./urls-BCmeQMIb.js";

7import { t as HostResolution } from "./host-resolution-C18FwVrM.js";

8import { o as handleApiError } from "./api-CwhOyprf.js";

dist/smoke-test-ci.shView file

•path = dist/smoke-test-ci.sh kind = build_helper sizeBytes = 5579 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/smoke-test-ci.shView on unpkg

dist/agent-interface-kOuzXg84.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @posthog/wizard@2.36.0 matchedIdentity = npm:QHBvc3Rob2cvd2l6YXJk:2.36.0 similarity = 0.683 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agent-interface-kOuzXg84.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/package-manager-C5VVQHQ-.jsView file

1import { s as detectAllPackageManagers } from "./setup-utils-v9I6PQyP.js"; L2: import { execSync } from "node:child_process"; L3: //#region src/frameworks/python/utils.ts

High

Child Process

Package source references child process execution.

dist/package-manager-C5VVQHQ-.jsView on unpkg · L1

dist/wizard-tools-C8nVWLeI.jsView file

577attempts.push({ L578: tool: "powershell.exe", L579: args: [

High

Shell

Package source references shell execution.

dist/wizard-tools-C8nVWLeI.jsView on unpkg · L577

299start(id) { L300: const t = this.require(id); L301: t.status = TaskStatus.Running;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/wizard-tools-C8nVWLeI.jsView on unpkg · L299

dist/bin.jsView file

25Cross-file remote execution chain: dist/bin.js spawns dist/debug-CaRHQrDY.js; helper contains network access plus dynamic code execution. L25: import * as path$1 from "node:path"; L26: import { spawnSync } from "node:child_process"; L27: import * as fs$1 from "node:fs"; L28: import axios from "axios"; L29: import { z } from "zod"; ... L170: const text = msg || err && err.message || "Invalid arguments"; L171: process.stderr.write(`\n\x1b[1;91m✖ ${text}\x1b[0m\n Run \`wizard --help\` to see available commands and options.\n\n`); L172: process.exit(1); ... L188: const argvHasCI = args.some((a) => a === "--ci" || a === "--no-ci" || a.startsWith("--ci=")); L189: const envHasCI = process.env.POSTHOG_WIZARD_CI != null && process.env.POSTHOG_WIZARD_CI !== ""; L190: if (argvHasCI || envHasCI) { ... L345: /**

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin.jsView on unpkg · L25

dist/smoke-test-ci.shView file

•path = dist/smoke-test-ci.sh kind = build_helper sizeBytes = 5579 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/smoke-test-ci.shView on unpkg

dist/agent-interface-kOuzXg84.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agent-interface-kOuzXg84.jsView on unpkg

Findings

1 Critical3 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/agent-interface-kOuzXg84.js

HighChild Processdist/package-manager-C5VVQHQ-.js

HighShelldist/wizard-tools-C8nVWLeI.js

HighCross File Remote Execution Contextdist/bin.js

MediumDynamic Requiredist/wizard-tools-C8nVWLeI.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/smoke-test-ci.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

6 flagged

dist/package-manager-C5VVQHQ-.jsView file

Lines 1-21javascript

1import { s as detectAllPackageManagers } from "./setup-utils-v9I6PQyP.js";

2import { execSync } from "node:child_process";

3//#region src/frameworks/python/utils.ts

High

Child Process

Package source references child process execution.

dist/package-manager-C5VVQHQ-.jsView on unpkg · L1

4/**

5* Get the installed Python version

6*/

7function getPythonVersion(options) {

8 try {

9 return execSync("python --version || python3 --version", {

10 cwd: options.installDir,

11 encoding: "utf-8"

12 }).trim().replace("Python ", "");

13 } catch {

14 return;

15 }

16}

17/**

18* Bucket Python version for analytics (e.g., "3.11.x" -> "3.11")

19*/

20function getPythonVersionBucket(version) {

21 const match = version.match(/^(\d+\.\d+)/);

dist/wizard-tools-C8nVWLeI.jsView file

Lines 279-319javascript

279 }

280 enqueue(input) {

281 const task = {

282 id: randomUUID(),

283 type: input.type,

284 label: input.label,

285 status: TaskStatus.Pending,

286 dependsOn: input.dependsOn ?? [],

287 inputs: input.inputs

dist/bin.jsView file

Lines 5-45javascript

5import { n as isUsingTypeScript } from "./setup-utils-v9I6PQyP.js";

6import { o as getUiHostFromHost } from "./urls-BCmeQMIb.js";

7import { t as HostResolution } from "./host-resolution-C18FwVrM.js";

8import { o as handleApiError } from "./api-CwhOyprf.js";

dist/smoke-test-ci.shView file

•path = dist/smoke-test-ci.sh kind = build_helper sizeBytes = 5579 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/smoke-test-ci.shView on unpkg

dist/agent-interface-kOuzXg84.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agent-interface-kOuzXg84.jsView on unpkg