registry / @wirecat/max-cli / 0.92.0
@wirecat/max-cli@0.92.0
MAX Messenger bots through the official Bot API, and a personal MAX account, from the terminal — built for agents and scripts
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe inspected install hooks are gated to global setup, and agent skill installation requires an explicit environment choice. Provider credentials follow the selected analysis endpoint, while MAX account credentials are entered or supplied for an explicit session command; the routed evidence did not establish an unrelated collector or hidden execution.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Install lifecycle setup is limited to global installs; account and AI-provider credential use is tied to explicit CLI operations.
Impact
No unauthorized credential transfer, unrelated collection, or concealed execution was established.
Mechanism
Inspected code performs gated PATH and optional skill setup, and uses configured service endpoints for provider requests.
AI rationale
The inspected install hooks are gated to global setup, and agent skill installation requires an explicit environment choice. Provider credentials follow the selected analysis endpoint, while MAX account credentials are entered or supplied for an explicit session command; the routed evidence did not establish an unrelated collector or hidden execution.
Network endpoints2
api.anthropic.comapi.openai.com
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall wrapper imports setup code only for global installs; the setup also returns unless npm marks the install global.
- Global setup updates Windows PATH and installs the agent skill only when MAX_INSTALL_AGENT is explicitly set to a supported target.
- AI-provider keys are read for analysis using the configured provider endpoint; default endpoints are api.anthropic.com and api.openai.com.
- MAX_TOKEN is prompted for or read from the environment during an explicit session-start command.
- The online doctor starts the package’s own MCP server to list tools; its source says listing tools does not log in.
Evidence against
- The package has prepare and postinstall lifecycle scripts, which merit review, but the inspected actions are setup-related and gated.
- The CLI has network, process, and file-writing capabilities consistent with its messenger, MCP, and account-management functions.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEval
Source & flagged code
17 flaggedpackage.jsonView file
•scripts.postinstall = node install/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/online.jsView file
1import { spawn } from "node:child_process";
L2: import { createInterface } from "node:readline";
High
Findings
4 Critical9 High7 Medium6 Low
CriticalRemote Asset Decode Executedist/bundle/program-RS5VYXIP.js
CriticalTrojan Source Unicodedist/bundle/chunk-675PVDJB.js
CriticalTrigger Reachable Dangerous Capabilitydist/bundle/program-RS5VYXIP.js
CriticalPrevious Version Dangerous Deltadist/bundle/chunk-675PVDJB.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/online.js
HighSame File Env Network Executiondist/bundle/program-RS5VYXIP.js
HighCredential Redirect Persistencedist/bundle/program-RS5VYXIP.js
HighSandbox Evasion Gated Capabilitydist/bundle/program-RS5VYXIP.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/bundle/chunk-YXKU4EZL.js
Affected versions and remediation
This report applies to @wirecat/max-cli@0.92.0.
See all versions of @wirecat/max-cli for other recorded verdicts.
- Review the evidence and your use of @wirecat/max-cli@0.92.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.