registry / @windmill-labs/components / 1.754.0
@windmill-labs/components@1.754.0
The Windmill frontend written in Svelte 5 + Tailwind CSS
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic lifecycle detection is a false positive here: its only target is absent from the extracted package, so the guarded command is inert. Reviewed shipped source shows UI components, templates, and client-side service use without a concrete malicious chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation
Impact
No observed install-time mutation, payload execution, exfiltration, persistence, or AI-agent control-surface change.
Mechanism
guarded existence check for absent UI-builder helper
AI rationale
Static lifecycle detection is a false positive here: its only target is absent from the extracted package, so the guarded command is inert. Reviewed shipped source shows UI components, templates, and client-side service use without a concrete malicious chain.
Evidence
package.jsonpackage/script_helpers.jspackage/ata/edgeCases.jspackage/system_prompts/prompts.jspackage/components/assets/AssetGraph/parsePipelineAnnotations.parity.test.js
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines a postinstall shell command.
Evidence against
- package.json postinstall runs only if ./scripts/untar_ui_builder.js exists.
- The extracted package contains no scripts/untar_ui_builder.js target.
- No executable files were found under package/.
- package/script_helpers.js is imported by UI editors for script templates.
- Node API matches are comments, tests, or template text; no package-side execution chain found.
- No foreign AI-agent configuration paths or install-time writes were found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedObfuscatedUrlStrings
CopyleftLicense
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = node -e "if (require('fs').existsSync('./scripts/untar_ui_builder.js')) { require('child_process').execSync('node ./scripts/untar_ui_builder.js', {stdio: 'inherit'}) }"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "if (require('fs').existsSync('./scripts/untar_ui_builder.js')) { require('child_process').execSync('node ./scripts/untar_ui_builder.js', {stdio: 'inherit'}) }"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackage.json#scripts.postinstallView file
1if (require('fs').existsSync('./scripts/untar_ui_builder.js')) { require('child_process').execSync('node ./scripts/untar_ui_builder.js', {stdio: 'inherit'}) }
Findings
1 Critical2 High5 Medium6 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighEntrypoint Build Divergencepackage/script_helpers.js
MediumDynamic Requirepackage.json#scripts.postinstall
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperpackage/components/copilot/prompts/yaml2json.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
Affected versions and remediation
This report applies to @windmill-labs/components@1.754.0.
See all versions of @windmill-labs/components for other recorded verdicts.
- Review the evidence and your use of @windmill-labs/components@1.754.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.