registry / @wirecat/max-cli / 0.89.0
@wirecat/max-cli@0.89.0
MAX Messenger bots through the official Bot API, and a personal MAX account, from the terminal — built for agents and scripts
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe reviewed source supports the package's stated MAX CLI purpose. The flagged postinstall and agent configuration behavior is gated to global installation and explicit opt-in, while the examined credential path defaults to official provider APIs.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The CLI runs when invoked; global install setup runs only for global installs, and agent skill installation requires an explicit setting or command.
Impact
No unwanted data collection, credential redirection, remote code execution, or automatic agent configuration change was identified.
Mechanism
Analysis credentials are read for the selected provider and sent to its configured endpoint; the default endpoints are the official OpenAI and Anthropic APIs. Skill files are written only through the skill installation flow.
AI rationale
The reviewed source supports the package's stated MAX CLI purpose. The flagged postinstall and agent configuration behavior is gated to global installation and explicit opt-in, while the examined credential path defaults to official provider APIs.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package describes a MAX Messenger CLI, and its executable is a CLI entry point.
- The postinstall script runs its setup only for global installs; agent skill installation requires MAX_INSTALL_AGENT to be set to a supported target.
- Analysis credentials use the selected provider's official API by default; custom endpoints are configurable and validated.
- The hidden Unicode characters flagged in the chunk occur in a filename-sanitizing regular expression that removes control and bidirectional characters.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
16 flaggedpackage.jsonView file
•scripts.postinstall = node install/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/online.jsView file
1import { spawn } from "node:child_process";
L2: import { createInterface } from "node:readline";
High
Findings
3 Critical9 High7 Medium6 Low
CriticalRemote Asset Decode Executedist/bundle/program-EK7J4DJO.js
CriticalTrojan Source Unicodedist/bundle/chunk-744HKSF4.js
CriticalTrigger Reachable Dangerous Capabilitydist/bundle/program-EK7J4DJO.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/online.js
HighSame File Env Network Executiondist/bundle/program-EK7J4DJO.js
HighCredential Redirect Persistencedist/bundle/program-EK7J4DJO.js
HighSandbox Evasion Gated Capabilitydist/bundle/program-EK7J4DJO.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/bundle/chunk-XUW5RPLE.js
HighCross File Remote Execution Contextdist/bundle/chunk-CREJAQ2K.js
Affected versions and remediation
This report applies to @wirecat/max-cli@0.89.0.
See all versions of @wirecat/max-cli for other recorded verdicts.
- Review the evidence and your use of @wirecat/max-cli@0.89.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.