registry / @wirecat/max-cli / 0.84.0

@wirecat/max-cli@0.84.0

⚠ Under review

MAX Messenger bots through the official Bot API, and a personal MAX account, from the terminal — built for agents and scripts

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 25 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 237 file(s), 11.4 MB of source, external domains: ai.google.dev, api.anthropic.com, api.cas.chat, api.lols.bot, api.openai.com, bot.example.ts.net, cas.chat, dev.max.ru, docs.anthropic.com, docs.expo.dev, example.com, example.test, github.com, huggingface.co, json-schema.org, laptop.example.ts.net, max.ru, omub.okcdn.ru, platform-api2.max.ru, platform.claude.com, purl.oclc.org, raw.githubusercontent.com, registry.npmjs.org, schemas.openxmlformats.org, t.me, ts.sdk.modelcontextprotocol.io, web.max.ru, www.apple.com, www.idpf.org, www.w3.org

Source & flagged code

16 flagged

package.jsonView file

•scripts.postinstall = node install/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/online.jsView file

1import { spawn } from "node:child_process"; L2: import { createInterface } from "node:readline";

High

Child Process

Package source references child process execution.

dist/online.jsView on unpkg · L1

Findings

3 Critical9 High7 Medium6 Low

CriticalRemote Asset Decode Executedist/bundle/program-PIYZNSPO.js

CriticalTrojan Source Unicodedist/bundle/chunk-EC5UD3WE.js

CriticalTrigger Reachable Dangerous Capabilitydist/bundle/program-PIYZNSPO.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/online.js

HighSame File Env Network Executiondist/bundle/program-PIYZNSPO.js

HighCredential Redirect Persistencedist/bundle/program-PIYZNSPO.js

HighSandbox Evasion Gated Capabilitydist/bundle/program-PIYZNSPO.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/bundle/chunk-32LDFYA5.js

HighCross File Remote Execution Contextdist/bundle/chunk-JFGIETJV.js

Affected versions and remediation

This report applies to @wirecat/max-cli@0.84.0.

See all versions of @wirecat/max-cli for other recorded verdicts.

Review the evidence and your use of @wirecat/max-cli@0.84.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-27 23:15:03.717Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @wirecat/max-cli / 0.84.0

@wirecat/max-cli@0.84.0

⚠ Under review

MAX Messenger bots through the official Bot API, and a personal MAX account, from the terminal — built for agents and scripts

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 25 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

16 flagged

package.jsonView file

•scripts.postinstall = node install/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/online.jsView file

1import { spawn } from "node:child_process"; L2: import { createInterface } from "node:readline";

High

Child Process

Package source references child process execution.

dist/online.jsView on unpkg · L1

Findings

3 Critical9 High7 Medium6 Low

CriticalRemote Asset Decode Executedist/bundle/program-PIYZNSPO.js

CriticalTrojan Source Unicodedist/bundle/chunk-EC5UD3WE.js

CriticalTrigger Reachable Dangerous Capabilitydist/bundle/program-PIYZNSPO.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/online.js

HighSame File Env Network Executiondist/bundle/program-PIYZNSPO.js

HighCredential Redirect Persistencedist/bundle/program-PIYZNSPO.js

HighSandbox Evasion Gated Capabilitydist/bundle/program-PIYZNSPO.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/bundle/chunk-32LDFYA5.js

HighCross File Remote Execution Contextdist/bundle/chunk-JFGIETJV.js

Affected versions and remediation

This report applies to @wirecat/max-cli@0.84.0.

See all versions of @wirecat/max-cli for other recorded verdicts.

Review the evidence and your use of @wirecat/max-cli@0.84.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-27 23:15:03.717Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.