registry / @viudes/windsurf-api / 0.1.2

@viudes/windsurf-api@0.1.2

AI Security Review

scanned 21d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package is an explicit Windsurf/Codeium API proxy with user-invoked credential registration, LS binary installation, dashboard administration, and optional special-agent process spawning.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs windsurf-api start/install/login or authenticated dashboard actions

Impact

Expected local state changes and upstream API calls; no unconsented install-time execution or exfiltration found

Mechanism

package-aligned proxy server, account persistence, and optional language-server download

Rationale

Static inspection found risky primitives, but they are tied to the package's documented API proxy, login, dashboard, and language-server setup workflows and are not activated during npm install. I found no unrelated exfiltration endpoint, hidden lifecycle execution, destructive behavior, or unconsented AI-agent control-surface modification.

Evidence

package.jsonsrc/app/index.jssrc/app/cli.jssrc/core/config.jssrc/account-pool/auth.jssrc/dashboard/windsurf-login.jssrc/dashboard/api.jssrc/language-server/windsurf-api.jsinstall-ls.shsrc/special-agent/special-agent.jssrc/special-agent/devin-acp.js~/.windsurf-api/accounts.json~/.windsurf-api/opt/windsurf$HOME/.windsurf./.env./config.json/tmp/windsurf-workspace*

Network endpoints11

Decision evidence

public snapshot

AI called this Clean at 84.0% confidence as Benign with medium false-positive risk.

Evidence for block

src/app/index.js auto-runs install-ls.sh via execSync when user starts server and LS binary is missing
install-ls.sh downloads executable LS binaries from GitHub/Exafunction endpoints and installs to LS_INSTALL_PATH
src/dashboard/api.js exposes authenticated /langserver/update that can run install-ls.sh with allowlisted HTTPS URL
src/special-agent/*.js can spawn configured Devin ACP commands when special-agent paths are used

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks
src/app/cli.js only imports src/app/index.js for explicit start/default command, not at package install
credential handling is package-aligned: login/API keys are stored for Windsurf/Codeium proxy accounts in accounts.json
network calls target declared Windsurf/Codeium/Devin/Firebase/GitHub proxy and LS update functions
no source evidence of credential harvesting to unrelated endpoints, persistence, destructive project writes, or AI-agent control-surface mutation

Behavioral surface

Source

ChildProcessCrypto

Source & flagged code

5 flagged

src/dashboard/windsurf-login.jsView file

12patternName = google_api_key severity = high line = 12 matchedText = const FI...cY';

High

High Secret

Package contains a high-severity secret pattern.

src/dashboard/windsurf-login.jsView on unpkg · L12

12patternName = google_api_key severity = high line = 12 matchedText = const FI...cY';

High

Secret Pattern

Google API key in src/dashboard/windsurf-login.js

src/dashboard/windsurf-login.jsView on unpkg · L12

src/core/config.jsView file

29} L30: if (!process.env[key]) { L31: process.env[key] = val; ... L43: try { L44: parsed = JSON.parse(readFileSync(cfgPath, 'utf-8')); L45: } catch (e) { ... L69: // `replica-${HOSTNAME}` subdir. L70: // Default data dir: a hidden per-user folder. os.homedir() resolves to the L71: // right place on every OS (Linux ~/, macOS /Users/<u>, Windows C:\Users\<u>), ... L88: L89: export function defaultLsBinaryPath(platform = process.platform, arch = process.arch, home = process.env.HOME) { L90: if (platform === 'darwin') {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/core/config.jsView on unpkg · L29

install-ls.shView file

•path = install-ls.sh kind = build_helper sizeBytes = 6237 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-ls.shView on unpkg

src/app/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @viudes/windsurf-api@0.1.1 matchedIdentity = npm:QHZpdWRlcy93aW5kc3VyZi1hcGk:0.1.1 similarity = 0.944 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

src/app/index.jsView on unpkg

Source & flagged code

5 flagged · loading source

src/dashboard/windsurf-login.jsView file

12patternName = google_api_key severity = high line = 12 matchedText = const FI...cY';

High

High Secret

Package contains a high-severity secret pattern.

src/dashboard/windsurf-login.jsView on unpkg · L12

12patternName = google_api_key severity = high line = 12 matchedText = const FI...cY';

High

Secret Pattern

Google API key in src/dashboard/windsurf-login.js

src/dashboard/windsurf-login.jsView on unpkg · L12

src/core/config.jsView file

Findings

1 Critical3 High4 Medium4 Low

CriticalPrevious Version Dangerous Deltasrc/app/index.js

HighHigh Secretsrc/dashboard/windsurf-login.js

HighSandbox Evasion Gated Capabilitysrc/core/config.js

HighSecret Patternsrc/dashboard/windsurf-login.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinstall-ls.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings