registry  /  @wave-ai-os/wave-cli  /  0.1.62

@wave-ai-os/wave-cli@0.1.62

Machine-first CLI used by a Node LangGraph agent to execute semantic Wave operations against the Rails API.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 5 file(s), 1.19 MB of source, external domains: app.ourwave.io

Source & flagged code

4 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall-local-bin.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
dist/index.jsView file
1812// src/authStorage.ts L1813: import { execFile } from "child_process"; L1814: import { constants, existsSync } from "fs";
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1812
10214if (new URL(baseUrl).hostname.toLowerCase() === "api.ourwave.io") { L10215: const loginUrl = new URL("https://app.ourwave.io/login"); L10216: loginUrl.searchParams.set("next", authorizeUrl); ... L10221: function canOpenBrowser(noBrowser) { L10222: return noBrowser !== true && process.stdin.isTTY === true && process.stdout.isTTY === true && process.env.CI !== "true"; L10223: } ... L10226: const args = process.platform === "win32" ? ["/c", "start", "", url] : [url]; L10227: const child = spawn(command, args, { detached: true, stdio: "ignore" }); L10228: child.unref();
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L10214
30details; L31: exitCode; L32: constructor(params) { ... L108: function getConfig(options) { L109: const token = options.token ?? options.jwt ?? process.env.WAVE_API_TOKEN ?? process.env.WAVE_JWT; L110: if (!token) { ... L341: status: params.status, L342: data: params.data, L343: error: params.error, ... L348: try { L349: return JSON.parse(input); L350: } catch {
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L30

Findings

5 High3 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License