registry  /  @wave-ai-os/wave-cli  /  0.1.70

@wave-ai-os/wave-cli@0.1.70

Machine-first CLI used by a Node LangGraph agent to execute semantic Wave operations against the Rails API.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 6 file(s), 1.24 MB of source, external domains: api.ourwave.io, app.ourwave.io, json-schema.org

Source & flagged code

4 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall-local-bin.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
dist/index.jsView file
1805// src/authStorage.ts L1806: import { execFile } from "child_process"; L1807: import { constants, existsSync } from "fs";
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1805
10195if (new URL(baseUrl).hostname.toLowerCase() === "api.ourwave.io") { L10196: const loginUrl = new URL("https://app.ourwave.io/login"); L10197: loginUrl.searchParams.set("next", authorizeUrl); ... L10202: function canOpenBrowser(noBrowser) { L10203: return noBrowser !== true && process.stdin.isTTY === true && process.stdout.isTTY === true && process.env.CI !== "true"; L10204: } ... L10207: const args = process.platform === "win32" ? ["/c", "start", "", url] : [url]; L10208: const child = spawn(command, args, { detached: true, stdio: "ignore" }); L10209: child.unref();
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L10195
30details; L31: exitCode; L32: constructor(params) { ... L60: // src/runtimeDefaults.ts L61: var DEFAULT_PRODUCTION_API_BASE_URL = "https://api.ourwave.io"; L62: ... L111: function getConfig(options) { L112: const token = options.token ?? process.env.WAVE_API_TOKEN; L113: if (!token) { ... L334: status: params.status, L335: data: params.data, L336: error: params.error,
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L30

Findings

5 High3 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License