@wathba-cli/cli: Suspicious npm security report (Warn)

Static Scan Results

scanned 12h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 5 file(s), 31.7 KB of source

Source & flagged code

2 flagged

package.jsonView file

Lines 1-39json

1{

2 "name": "@wathba-cli/cli",

3 "version": "1.4.10",

4 "description": "Agent-first CLI for the Wathba developer platform",

5 "license": "UNLICENSED",

6 "homepage": "https://github.com/wathba-org/wathba-cli#readme",

7 "bugs": {

8 "url": "https://github.com/wathba-org/wathba-cli/issues"

9 },

10 "repository": {

11 "type": "git",

12 "url": "git+https://github.com/wathba-org/wathba-cli.git"

13 },

14 "type": "commonjs",

15 "bin": {

16 "wathba": "bin/wathba.js"

17 },

18 "scripts": {

19 "postinstall": "node install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L19

20 "test": "node --test"

21 },

22 "files": [

23 "bin/",

24 "lib/",

25 "install.js",

26 "README.md"

27 ],

28 "engines": {

29 "node": ">=18.18.0"

30 },

31 "os": [

32 "darwin",

33 "linux",

34 "win32"

35 ],

36 "cpu": [

37 "x64",

38 "arm64"

39 ],

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

@wathba-cli/cli@1.4.10

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code