registry / @wevion/cli / 1.0.2503

@wevion/cli@1.0.2503

Wevion API command-line interface — generated from the public OpenAPI spec

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 47.6 KB of source, external domains: 127.0.0.1, api-stage.wevion.ai, api.wevion.ai, registry.npmjs.org

Source & flagged code

4 flagged

src/index.mjsView file

Lines 5-45javascript

5//

6// wevion <command> [--param value ...]

7// wevion list # list all commands

8// wevion help <command> # show a command's params

9//

10// Auth: WEVION_API_KEY (x-api-key). Base URL: WEVION_BASE_URL or --base-url.

12import { parseArgs } from 'node:util'

13import {

14 chmodSync,

15 mkdirSync,

16 readFileSync,

17 realpathSync,

18 renameSync,

19 rmSync,

20 writeFileSync,

21} from 'node:fs'

22import { homedir } from 'node:os'

23import { createInterface } from 'node:readline/promises'

24import { fileURLToPath } from 'node:url'

25import { dirname, join } from 'node:path'

26import { spawn } from 'node:child_process'

28const HTTP_METHODS = ['get', 'post', 'put', 'patch', 'delete']

29const JSON_CONTENT_TYPE = 'application/json'

30const SUPPORTED_AUTH_SCHEMES = new Set(['apiKeyAuth'])

31// ponytail: hardcoded prod default; stage via --base-url / WEVION_BASE_URL / config.

32const DEFAULT_BASE_URL = 'https://api.wevion.ai'

33const DEFAULT_TIMEOUT_MS = 30_000

34const DEFAULT_SPEC_TIMEOUT_MS = 3000

36// ~/.config/wevion/config.json (honours XDG_CONFIG_HOME). Stores { apiKey, baseUrl }.

37export function configPath(env = process.env, platform = process.platform) {

38 if (platform === 'win32') {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/index.mjsView on unpkg · L25

39 const base = env.APPDATA || join(env.USERPROFILE || env.HOME || homedir(), 'AppData', 'Roaming')

40 return join(base, 'Wevion', 'config.json')

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/index.mjsView on unpkg · L25

41 }

42 const base = env.XDG_CONFIG_HOME || join(env.HOME || homedir(), '.config')

43 return join(base, 'wevion', 'config.json')

44}

Lines 697-737javascript

697

698function isLoopbackHostname(hostname) {

699 const h = hostname.toLowerCase()

700 return h === 'localhost' || h === '::1' || h === '[::1]' || /^127\./

selftest.mjsView file

Lines 1-27javascript

1// Minimal runnable check for the spec->request mapping. Run: node selftest.mjs

2import assert from 'node:assert/strict'

3import { mkdtempSync, statSync } from 'node:fs'

4import { readFile } from 'node:fs/promises'

5import { createServer } from 'node:http'

6import { tmpdir } from 'node:os'

7import

Source & flagged code

4 flagged · loading source

src/index.mjsView file

25import { dirname, join } from 'node:path' L26: import { spawn } from 'node:child_process' L27: ... L31: // ponytail: hardcoded prod default; stage via --base-url / WEVION_BASE_URL / config. L32: const DEFAULT_BASE_URL = 'https://api.wevion.ai' L33: const DEFAULT_TIMEOUT_MS = 30_000 ... L36: // ~/.config/wevion/config.json (honours XDG_CONFIG_HOME). Stores { apiKey, baseUrl }. L37: export function configPath(env = process.env, platform = process.platform) { L38: if (platform === 'win32') {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/index.mjsView on unpkg · L25

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/index.mjsView on unpkg · L25

717patternName = generic_password severity = medium line = 717 matchedText = if (url....ED]'

Medium

Secret Pattern

Package contains a possible secret pattern.

src/index.mjsView on unpkg · L717

selftest.mjsView file

7import { join } from 'node:path' L8: import { spawn } from 'node:child_process' L9: import { fileURLToPath } from 'node:url'

High

Child Process

Package source references child process execution.

selftest.mjsView on unpkg · L7

Findings

4 High4 Medium5 Low

HighChild Processselftest.mjs

HighShell

HighSame File Env Network Executionsrc/index.mjs

HighSandbox Evasion Gated Capabilitysrc/index.mjs

MediumSecret Patternsrc/index.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

src/index.mjsView file

Lines 5-45javascript

5//

6// wevion <command> [--param value ...]

7// wevion list # list all commands

8// wevion help <command> # show a command's params

9//

10// Auth: WEVION_API_KEY (x-api-key). Base URL: WEVION_BASE_URL or --base-url.

12import { parseArgs } from 'node:util'

13import {

14 chmodSync,

15 mkdirSync,

16 readFileSync,

17 realpathSync,

18 renameSync,

19 rmSync,

20 writeFileSync,

21} from 'node:fs'

22import { homedir } from 'node:os'

23import { createInterface } from 'node:readline/promises'

24import { fileURLToPath } from 'node:url'

25import { dirname, join } from 'node:path'

26import { spawn } from 'node:child_process'

28const HTTP_METHODS = ['get', 'post', 'put', 'patch', 'delete']

29const JSON_CONTENT_TYPE = 'application/json'

30const SUPPORTED_AUTH_SCHEMES = new Set(['apiKeyAuth'])

31// ponytail: hardcoded prod default; stage via --base-url / WEVION_BASE_URL / config.

32const DEFAULT_BASE_URL = 'https://api.wevion.ai'

33const DEFAULT_TIMEOUT_MS = 30_000

34const DEFAULT_SPEC_TIMEOUT_MS = 3000

36// ~/.config/wevion/config.json (honours XDG_CONFIG_HOME). Stores { apiKey, baseUrl }.

37export function configPath(env = process.env, platform = process.platform) {

38 if (platform === 'win32') {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/index.mjsView on unpkg · L25

39 const base = env.APPDATA || join(env.USERPROFILE || env.HOME || homedir(), 'AppData', 'Roaming')

40 return join(base, 'Wevion', 'config.json')

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/index.mjsView on unpkg · L25

41 }

42 const base = env.XDG_CONFIG_HOME || join(env.HOME || homedir(), '.config')

43 return join(base, 'wevion', 'config.json')

44}

Lines 697-737javascript

697

698function isLoopbackHostname(hostname) {

699 const h = hostname.toLowerCase()

700 return h === 'localhost' || h === '::1' || h === '[::1]' || /^127\./

selftest.mjsView file

Lines 1-27javascript

1// Minimal runnable check for the spec->request mapping. Run: node selftest.mjs

2import assert from 'node:assert/strict'

3import { mkdtempSync, statSync } from 'node:fs'

4import { readFile } from 'node:fs/promises'

5import { createServer } from 'node:http'

6import { tmpdir } from 'node:os'

7import