registry / @wirecat/max-cli / 0.85.0

@wirecat/max-cli@0.85.0

MAX Messenger bots through the official Bot API, and a personal MAX account, from the terminal — built for agents and scripts

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The flagged lifecycle and agent-configuration behavior is gated: postinstall setup runs only for global installs, and agent skill writes require MAX_INSTALL_AGENT selection. The inspected API-key flow uses the configured endpoint or the official provider endpoint; the scanner’s other claims were not substantiated by the inspected excerpts.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The CLI runs when invoked; global-install setup is gated on npm's global-install setting.

Impact

No unauthorized credential forwarding, concealed execution, or unrequested agent configuration change was established.

Mechanism

The inspected credential flow selects the configured or official provider endpoint. Agent skill writes require an explicit environment selection.

AI rationale

Network endpoints2

api.anthropic.comapi.openai.com/v1

Decision evidence

public snapshot

AI called this Clean at 79.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The postinstall wrapper only invokes its setup when npm reports a global install.
Agent skill installation is skipped by default and requires MAX_INSTALL_AGENT to select a target.
The analysis flow uses the configured endpoint or the provider’s official Anthropic/OpenAI endpoint.
The manifest’s prepare script installs Lefthook; no malicious lifecycle behavior was identified.

Evidence against

The package has a postinstall hook and code that can write agent skill files, but the write is opt-in.
The flagged source includes network and process execution functionality consistent with a CLI for MAX and AI services.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

Source & flagged code

16 flagged

package.jsonView file

•scripts.postinstall = node install/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/online.jsView file

1import { spawn } from "node:child_process"; L2: import { createInterface } from "node:readline";

High

Child Process

Package source references child process execution.

dist/online.jsView on unpkg · L1

Findings

3 Critical9 High7 Medium6 Low

CriticalRemote Asset Decode Executedist/bundle/program-QYEL4XIJ.js

CriticalTrojan Source Unicodedist/bundle/chunk-6N65A5VV.js

CriticalTrigger Reachable Dangerous Capabilitydist/bundle/program-QYEL4XIJ.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/online.js

HighSame File Env Network Executiondist/bundle/program-QYEL4XIJ.js

HighCredential Redirect Persistencedist/bundle/program-QYEL4XIJ.js

HighSandbox Evasion Gated Capabilitydist/bundle/program-QYEL4XIJ.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/bundle/chunk-DAHPXOQI.js

HighCross File Remote Execution Contextdist/bundle/chunk-5PYDQI4U.js

Affected versions and remediation

This report applies to @wirecat/max-cli@0.85.0.

See all versions of @wirecat/max-cli for other recorded verdicts.

Review the evidence and your use of @wirecat/max-cli@0.85.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 16:56:03.130Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @wirecat/max-cli / 0.85.0

@wirecat/max-cli@0.85.0

MAX Messenger bots through the official Bot API, and a personal MAX account, from the terminal — built for agents and scripts

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The CLI runs when invoked; global-install setup is gated on npm's global-install setting.

Impact

No unauthorized credential forwarding, concealed execution, or unrequested agent configuration change was established.

Mechanism

The inspected credential flow selects the configured or official provider endpoint. Agent skill writes require an explicit environment selection.

AI rationale

Network endpoints2

api.anthropic.comapi.openai.com/v1

Decision evidence

public snapshot

AI called this Clean at 79.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The postinstall wrapper only invokes its setup when npm reports a global install.
Agent skill installation is skipped by default and requires MAX_INSTALL_AGENT to select a target.
The analysis flow uses the configured endpoint or the provider’s official Anthropic/OpenAI endpoint.
The manifest’s prepare script installs Lefthook; no malicious lifecycle behavior was identified.

Evidence against

The package has a postinstall hook and code that can write agent skill files, but the write is opt-in.
The flagged source includes network and process execution functionality consistent with a CLI for MAX and AI services.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

Source & flagged code

16 flagged

package.jsonView file

•scripts.postinstall = node install/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/online.jsView file

1import { spawn } from "node:child_process"; L2: import { createInterface } from "node:readline";

High

Child Process

Package source references child process execution.

dist/online.jsView on unpkg · L1

Findings

3 Critical9 High7 Medium6 Low

CriticalRemote Asset Decode Executedist/bundle/program-QYEL4XIJ.js

CriticalTrojan Source Unicodedist/bundle/chunk-6N65A5VV.js

CriticalTrigger Reachable Dangerous Capabilitydist/bundle/program-QYEL4XIJ.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/online.js

HighSame File Env Network Executiondist/bundle/program-QYEL4XIJ.js

HighCredential Redirect Persistencedist/bundle/program-QYEL4XIJ.js

HighSandbox Evasion Gated Capabilitydist/bundle/program-QYEL4XIJ.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/bundle/chunk-DAHPXOQI.js

HighCross File Remote Execution Contextdist/bundle/chunk-5PYDQI4U.js

Affected versions and remediation

This report applies to @wirecat/max-cli@0.85.0.

See all versions of @wirecat/max-cli for other recorded verdicts.

Review the evidence and your use of @wirecat/max-cli@0.85.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 16:56:03.130Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.