@wild-moose/moose-cli@0.2.15
Wild Moose's command-line interface
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package’s CLI/import entry automatically initializes dd-trace, creating an undisclosed runtime tracing risk. The flagged bundle indicators were not confirmed as a secret or Trojan Source behavior, and no malicious credential or account-action flow was identified.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing the package or starting the moose CLI.
Impact
Runtime activity may be traced without users being told or given a package-level way to disable it.
Mechanism
The entry point calls tracer.init() from dd-trace at module load. The package source does not show what data is collected or where the tracer sends it.
AI rationale
The package’s CLI/import entry automatically initializes dd-trace, creating an undisclosed runtime tracing risk. The flagged bundle indicators were not confirmed as a secret or Trojan Source behavior, and no malicious credential or account-action flow was identified.
Evidence
build/index.js
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The executable entry initializes dd-trace at module load, including when the CLI starts.
- The package exposes build/index.js as both its CLI and import entry point, so the tracer initialization is automatic.
Evidence against
- The flagged bundle strings identify the Wild Moose API and an Auth0 client ID, consistent with the package’s service and login flow.
- Searches found no common bidi control characters or recognizable private-key and token prefixes in the flagged bundle.
- No source evidence showed automatic credential collection, unrelated account actions, or install-time data transmission.
Behavioral surface
DynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
4 flaggedbuild/ui/assets/index-BWnlqtKI.jsView file
11patternName = private_key_rsa
severity = critical
line = 11
Critical
Critical Secret
Package contains a critical-looking secret pattern.
build/ui/assets/index-BWnlqtKI.jsView on unpkg · L1167contains invisible/control Unicode U+200B (zero width space)
`)}var WF=new Intl.NumberFormat(`en-US`),GF=new Intl.DateTimeFormat(`en-US`,{month:`short`,day:`numeric`}),KF=e=>{let t=new Date(e);return Number.isNaN(t.getTime())?e:GF.format(t)},qF={verified:{label:`Passing`,Icon:Kf,toneClass:`text-succe
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
build/ui/assets/index-BWnlqtKI.jsView on unpkg · L6711patternName = private_key_rsa
severity = critical
line = 11
Critical
Secret Pattern
RSA private key in build/ui/assets/index-BWnlqtKI.js
build/ui/assets/index-BWnlqtKI.jsView on unpkg · L11Findings
3 Critical4 Medium5 Low
CriticalCritical Secretbuild/ui/assets/index-BWnlqtKI.js
CriticalTrojan Source Unicodebuild/ui/assets/index-BWnlqtKI.js
CriticalSecret Patternbuild/ui/assets/index-BWnlqtKI.js
MediumDynamic Requirebuild/ui/assets/index-BWnlqtKI.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @wild-moose/moose-cli@0.2.15.
See all versions of @wild-moose/moose-cli for other recorded verdicts.
- Review the evidence and your use of @wild-moose/moose-cli@0.2.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.