registry / @wave-ai-os/wave-cli / 0.1.73

@wave-ai-os/wave-cli@0.1.73

Machine-first CLI used by a Node LangGraph agent to execute semantic Wave operations against the Rails API.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 6 file(s), 1.27 MB of source, external domains: api.ourwave.io, app.ourwave.io, json-schema.org

Source & flagged code

4 flagged

package.jsonView file

Lines 1-35json

2 "name": "@wave-ai-os/wave-cli",

3 "version": "0.1.73",

4 "type": "module",

5 "bin": {

6 "wave": "dist/index.js"

7 },

8 "files": [

9 "dist",

10 "scripts"

11 ],

12 "scripts": {

13 "build": "tsup src/index.ts --format esm,cjs --dts --clean",

14 "dev": "node --disable-warning=DEP0205 --import tsx src/index.ts",

15 "test": "vitest run",

16 "verify:dev": "node scripts/verify-dev-api.mjs",

17 "benchmark:cli": "node scripts/benchmark-cli.mjs",

18 "postinstall": "node scripts/postinstall-local-bin.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

19 },

20 "engines": {

21 "node": ">=20"

22 },

23 "dependencies": {

24 "commander": "^14.0.1",

25 "zod": "^4.1.11"

26 },

27 "devDependencies": {

28 "@types/node": "^24.6.0",

29 "tsup": "^8.5.0",

30 "tsx": "^4.20.6",

31 "typescript": "^5.9.3",

32 "vitest": "^3.2.4"

33 }

34}

dist/index.jsView file

1805// src/authStorage.ts L1806: import { execFile } from "child_process"; L1807: import { constants, existsSync } from "fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1805

10189if (new URL(baseUrl).hostname.toLowerCase() === "api.ourwave.io") { L10190: const loginUrl = new URL("https://app.ourwave.io/login"); L10191: loginUrl.searchParams.set("next", authorizeUrl); ... L10196: function canOpenBrowser(noBrowser) { L10197: return noBrowser !== true && process.stdin.isTTY === true && process.stdout.isTTY === true && process.env.CI !== "true"; L10198: } ... L10201: const args = process.platform === "win32" ? ["/c", "start", "", url] : [url]; L10202: const child = spawn(command, args, { detached: true, stdio: "ignore" }); L10203: child.unref();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L10189

30details; L31: exitCode; L32: constructor(params) { ... L60: // src/runtimeDefaults.ts L61: var DEFAULT_PRODUCTION_API_BASE_URL = "https://api.ourwave.io"; L62: ... L111: function getConfig(options) { L112: const token = options.token ?? process.env.WAVE_API_TOKEN; L113: if (!token) { ... L334: status: params.status, L335: data: params.data, L336: error: params.error,

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

Source & flagged code

4 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code