@wirecat/max-cli@0.95.0
MAX Messenger bots through the official Bot API, and a personal MAX account, from the terminal — built for agents and scripts
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe CLI reports an account-identifying navigation event to MAX after its live client starts, without an evident disclosure or opt-out in the inspected source. The event is limited to MAX's own service and does not show credential exfiltration, so this warrants a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Starting the personal-account live client; the event is scheduled after the connection starts.
Impact
MAX may record a chat-list navigation against the user's account even though the CLI session did not involve opening that screen.
Mechanism
The client sends a NAV/GO chat-list event containing the MAX viewer ID, timestamp, and session ID to MAX's session logging service.
AI rationale
The CLI reports an account-identifying navigation event to MAX after its live client starts, without an evident disclosure or opt-out in the inspected source. The event is limited to MAX's own service and does not show credential exfiltration, so this warrants a warning rather than a block.
Evidence
dist/bundle/program-6XO3MEPZ.js
Network endpoints2
wss://api.oneme.ru/websocketweb.max.ru
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The live client sends a NAV/GO event to MAX containing the account viewer ID, timestamp, and session ID.
- After the live connection starts, a timer invokes the chat-list reporting method; the default delay is 20 seconds.
- The bundled client connects to MAX's WebSocket endpoint, wss://api.oneme.ru/websocket.
Evidence against
- The event goes to MAX's own service, not an unrelated collector, and contains navigation metadata rather than message contents or credentials.
- The postinstall wrapper only runs its setup when npm_config_global is true; the inspected path does not establish install-time network activity.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
17 flaggedpackage.jsonView file
•scripts.postinstall = node install/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/online.jsView file
1import { spawn } from "node:child_process";
L2: import { createInterface } from "node:readline";
High
Findings
4 Critical9 High7 Medium6 Low
CriticalRemote Asset Decode Executedist/bundle/program-6XO3MEPZ.js
CriticalTrojan Source Unicodedist/bundle/chunk-ZA3BUAD6.js
CriticalTrigger Reachable Dangerous Capabilitydist/bundle/program-6XO3MEPZ.js
CriticalPrevious Version Dangerous Deltadist/bundle/chunk-NPTJXR7S.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/online.js
HighSame File Env Network Executiondist/bundle/program-6XO3MEPZ.js
HighCredential Redirect Persistencedist/bundle/program-6XO3MEPZ.js
HighSandbox Evasion Gated Capabilitydist/bundle/program-6XO3MEPZ.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/bundle/chunk-Y5NU6KRQ.js
Affected versions and remediation
This report applies to @wirecat/max-cli@0.95.0.
See all versions of @wirecat/max-cli for other recorded verdicts.
- Review the evidence and your use of @wirecat/max-cli@0.95.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.