registry / @waniwani/sdk / 0.14.19

@waniwani/sdk@0.14.19

MCP distribution SDK. Build sales funnels, lead generation, booking, and quote apps on top of your MCP server. Event tracking, flows, widgets, knowledge base.

Static Scan Results

scanned 7h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 712 file(s), 20.2 MB of source, external domains: app.waniwani.ai, example.com, github.com, json-schema.org, react.dev, tailwindcss.com, waniwani.ai, www.w3.org

Source & flagged code

3 flagged

package.jsonView file

Lines 76-116json

76 "dist"

77 ],

78 "scripts": {

79 "build": "rm -rf dist && bun run typecheck && bun run lint && tsup && bun run build:chat-css && bun run build:embed-css",

80 "build:chat-css": "tailwindcss -i src/chat/web/tailwind.css -o dist/chat/styles.css --minify",

81 "build:embed-css": "bun run scripts/inline-embed-css.ts",

82 "dev": "tsx --watch src/index.ts",

83 "storybook": "storybook dev -p 6006",

84 "build-storybook": "storybook build",

85 "test": "bun test",

86 "typecheck": "tsc --noEmit",

87 "lint": "biome check .",

88 "lint:fix": "biome check . --write",

89 "prepublishOnly": "bun run build",

90 "release": "npm run release:patch",

91 "release:patch": "npm version patch && git push --follow-tags",

92 "release:minor": "npm version minor && git push --follow-tags",

93 "release:major": "npm version major && git push --follow-tags",

94 "release:beta": "npm version prerelease --preid beta && git push --follow-tags",

95 "release:alpha": "npm version prerelease --preid alpha && git push --follow-tags",

96 "postinstall": "lefthook install || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L96

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L96

97 },

98 "peerDependencies": {

99 "@modelcontextprotocol/sdk": "~1.29.0",

100 "@modelcontextprotocol/ext-apps": "~1.5.0",

101 "react": ">=18.0.0",

102 "zod": ">=4.0.0",

103 "@ai-sdk/react": ">=1.0.0",

104 "ai": ">=6.0.141",

105 "@ai-sdk/mcp": ">=1.0.0"

106 },

107 "peerDependenciesMeta": {

108 "@modelcontextprotocol/sdk": {

109 "optional": true

110 },

111 "@modelcontextprotocol/ext-apps": {

112 "optional": true

113 },

114 "zod": {

115 "optional": true

116 },

dist/vue-vine-KB45C76H.jsView file

Lines 1-2javascript

1import{a as r}from"./chunk-IL2UKTRC.js";import{a as s}from"./chunk-NE26G5AT.js";import{a as i}from"./chunk-S2PPVC2B.js";import{a as n}from"./chunk-QP24BTOT.js";import{a as t}from"./chunk-EDNJDK7E.js";import{a}from"./chunk-YTXGYW4C.js";

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = lefthook install || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = lefthook install || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/vue-vine-KB45C76H.jsView file

1import{a as r}from"./chunk-IL2UKTRC.js";import{a as s}from"./chunk-NE26G5AT.js";import{a as i}from"./chunk-S2PPVC2B.js";import{a as n}from"./chunk-QP24BTOT.js";import{a as t}from".... L2: //# sourceMappingURL=vue-vine-KB45C76H.js.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/vue-vine-KB45C76H.jsView on unpkg · L1

Findings

1 High5 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/vue-vine-KB45C76H.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

3 flagged

package.jsonView file

Lines 76-116json

76 "dist"

77 ],

78 "scripts": {

79 "build": "rm -rf dist && bun run typecheck && bun run lint && tsup && bun run build:chat-css && bun run build:embed-css",

80 "build:chat-css": "tailwindcss -i src/chat/web/tailwind.css -o dist/chat/styles.css --minify",

81 "build:embed-css": "bun run scripts/inline-embed-css.ts",

82 "dev": "tsx --watch src/index.ts",

83 "storybook": "storybook dev -p 6006",

84 "build-storybook": "storybook build",

85 "test": "bun test",

86 "typecheck": "tsc --noEmit",

87 "lint": "biome check .",

88 "lint:fix": "biome check . --write",

89 "prepublishOnly": "bun run build",

90 "release": "npm run release:patch",

91 "release:patch": "npm version patch && git push --follow-tags",

92 "release:minor": "npm version minor && git push --follow-tags",

93 "release:major": "npm version major && git push --follow-tags",

94 "release:beta": "npm version prerelease --preid beta && git push --follow-tags",

95 "release:alpha": "npm version prerelease --preid alpha && git push --follow-tags",

96 "postinstall": "lefthook install || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L96

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L96

97 },

98 "peerDependencies": {

99 "@modelcontextprotocol/sdk": "~1.29.0",

100 "@modelcontextprotocol/ext-apps": "~1.5.0",

101 "react": ">=18.0.0",

102 "zod": ">=4.0.0",

103 "@ai-sdk/react": ">=1.0.0",

104 "ai": ">=6.0.141",

105 "@ai-sdk/mcp": ">=1.0.0"

106 },

107 "peerDependenciesMeta": {

108 "@modelcontextprotocol/sdk": {

109 "optional": true

110 },

111 "@modelcontextprotocol/ext-apps": {

112 "optional": true

113 },

114 "zod": {

115 "optional": true

116 },

dist/vue-vine-KB45C76H.jsView file

Lines 1-2javascript