registry / AI-agent control-surface risk / @wan-ai/cli
@wan-ai/cli
CLI for wan.video generation workflows.
This report shows the evidence for @wan-ai/cli@0.0.3. 1 of 2 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has a concrete, automatic postinstall chain that writes a bundled skill into detected third-party agent directories. Under the firewall policy, this requires a publish block regardless of the otherwise package-aligned Wan CLI functionality.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm postinstall
Impact
A bundled instruction file becomes active in detected third-party AI-agent environments.
Mechanism
automatic cross-agent skill deployment
Policy narrative
Installing the package runs postinstall, which calls installAgentSkills. That code detects coding-agent commands or applications and copies the bundled wan-cli skill into home-directory skill locations including .codex, .claude, and .cursor. This is an unconsented install-time mutation of foreign AI-agent control surfaces.
AI rationale
The package has a concrete, automatic postinstall chain that writes a bundled skill into detected third-party agent directories. Under the firewall policy, this requires a publish block regardless of the otherwise package-aligned Wan CLI functionality.
Evidence
package.jsonscripts/postinstall.mjsscripts/install-skills.mjsskills/wan-cli/SKILL.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs postinstall automatically.
- postinstall invokes agent-skill installation without user confirmation.
- Installer detects installed coding agents and targets Codex, Claude Code, Cursor and others.
- Installer copies the bundled skill into detected agents' home-directory skill paths.
Evidence against
- The bundled skill describes Wan video-generation workflows.
- Observed runtime API endpoints are Wan service endpoints; no postinstall network request or credential exfiltration was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
1#!/usr/bin/env node
L2: import{randomUUID as ze}from"node:crypto";import{readFile as bs}from"node:fs/promises";import{basename as di,extname as Le}from"node:path";import H from"node:process";import{create...
L3: may adjust prices per`,"tongyi-wanx.member-and-credit.header.title":"Member & Credit","tongyi-wanx.price.change.confirm.Current":"Current","tongyi-wanx.price.change.confirm.AfterCh...
High
Child Process
Package source references child process execution.
dist/index.jsFindings
1 Critical5 High4 Medium5 Low
CriticalAi Agent Control Hijackscripts/install-skills.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @wan-ai/cli@0.0.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing @wan-ai/cli@0.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.