registry / @wayai/cli / 0.3.230
@wayai/cli@0.3.230
⚠ Under reviewWayAI CLI — sync hub configuration between local files and the platform
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe inspected CLI source does not establish malicious behavior: login sends a token to the caller-supplied API URL, and package installation is confined to an explicit update command. The runtime source for commander and js-yaml was unavailable, so the dependency review remains unresolved.
Static reason
One or more suspicious static signals were detected.
Trigger
Use of the CLI, which imports its declared runtime dependencies.
Impact
No malicious impact is confirmed; behavior in unavailable dependency source remains unassessed.
Mechanism
The available source shows caller-selected API URL handling and an explicit update command, but does not resolve the unavailable dependency behavior.
AI rationale
The inspected CLI source does not establish malicious behavior: login sends a token to the caller-supplied API URL, and package installation is confined to an explicit update command. The runtime source for commander and js-yaml was unavailable, so the dependency review remains unresolved.
Evidence
package.jsondist/index.js
Decision evidence
public snapshotAI called this Manual Review at 68.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares commander and js-yaml as runtime dependencies, but their package source was unavailable in the snapshot.
- The login command accepts an explicit --api-url, and token validation sends the supplied token to that URL.
Evidence against
- The package’s update command runs only when invoked; its npm commands are not lifecycle hooks.
- The inspected credential transfer is tied to a caller-supplied API URL, so it does not establish covert credential theft.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/index.jsView file
16770});
L16771: import { execFileSync } from "child_process";
L16772: import * as fs3 from "fs";
High
8512"type": "string",
L8513: "description": "The Bash script to run, as with `bash -c`. It runs in /workspace unless it changes directory."
L8514: },
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
CREDENTIAL_KEY_RE = /token|secret|credential|password|passwd|api[_-]?key|authorization|private[_-]?key|session[_-]?id|cookie|jwt/i;
NUMERIC_CREDENTIAL_KEY_RE = /(?:password|passwd|pin|token|secret|credential|api[_-]?key|authorization|private[_-]?key|session[_-]?id|cookie|jwt)$/i;
// Stripe API keys and webhook signing secrets. Keep this aligned with
// LLM provider API keys. The captured delimiter is deliberate: `_` may
[AUTH_TYPE.API_KEY]: "API Key",
"API Key": AUTH_TYPE.API_KEY,
SKILL_INSTALL_COMMAND = "mkdir -p .claude && npx skills add wayai-pro/wayai-skill -y";
external_exports.enum(["API Key", "Bearer Token", "Basi
Findings
6 High4 Medium4 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighObfuscated Payload Loaderdist/index.js
HighRuntime Package Installdist/index.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @wayai/cli@0.3.230.
See all versions of @wayai/cli for other recorded verdicts.
- Review the evidence and your use of @wayai/cli@0.3.230 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.