registry / @windmill-labs/components / 1.830.0
@windmill-labs/components@1.830.0
The Windmill frontend written in Svelte 5 + Tailwind CSS
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe postinstall hook only runs a helper if it exists, while the manifest limits published files to dist and package. The flagged host references are UI documentation links or a configurable API placeholder, with no evidence of automatic credential transmission.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Package installation.
Impact
No malicious install-time behavior was found in the inspected source.
Mechanism
The postinstall command checks for scripts/untar_ui_builder.js before invoking it; the package's files allowlist excludes scripts.
AI rationale
The postinstall hook only runs a helper if it exists, while the manifest limits published files to dist and package. The flagged host references are UI documentation links or a configurable API placeholder, with no evidence of automatic credential transmission.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall command checks whether scripts/untar_ui_builder.js exists before running it.
- The published file allowlist contains only dist and package, so scripts/untar_ui_builder.js is not included.
- The flagged Windmill URLs appear in UI documentation links and an API URL placeholder.
Evidence against
- The package defines a postinstall lifecycle script.
Behavioral surface
CryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
CopyleftLicense
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = node -e "if (require('fs').existsSync('./scripts/untar_ui_builder.js')) { require('child_process').execSync('node ./scripts/untar_ui_builder.js', {stdio: 'inherit'}) }"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "if (require('fs').existsSync('./scripts/untar_ui_builder.js')) { require('child_process').execSync('node ./scripts/untar_ui_builder.js', {stdio: 'inherit'}) }"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackage/utils/templateLiteral.test.jsView file
10expect(expr).not.toContain('\\`');
L11: expect(new Function('flow_input', 'results', 'return ' + expr)({ iter: { value: 'data.csv' }, hostname: 'host1' }, { config: '/tmp/cfg.json' })).toBe('--input data.csv --config /tm...
L12: });
Findings
1 Critical2 High4 Medium6 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedpackage/assets/app.css
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperpackage/components/copilot/prompts/yaml2json.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvalpackage/utils/templateLiteral.test.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
Affected versions and remediation
This report applies to @windmill-labs/components@1.830.0.
See all versions of @windmill-labs/components for other recorded verdicts.
- Review the evidence and your use of @windmill-labs/components@1.830.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.