registry / @wix/create-app / 0.0.260
@wix/create-app@0.0.260
Create Wix apps
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected source supports first-party agent extension setup through an explicit CLI command, warranting a warning under the supplied policy. The scanner's malicious label is not supported by a concrete install-hook attack or credential exfiltration chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Explicit project creation with installation enabled; selecting an IDE enables its MCP configuration.
Impact
Adds agent instructions and enables external MCP code to run; future launches may resolve updated releases.
Mechanism
Runs the skills installer without separate confirmation and writes project-local configuration that launches an unpinned Wix MCP package.
AI rationale
Inspected source supports first-party agent extension setup through an explicit CLI command, warranting a warning under the supplied policy. The scanner's malicious label is not supported by a concrete install-hook attack or credential exfiltration chain.
Evidence
build/index.jstemplates/app/.mcp.json.ejs.cursor/mcp.json.vscode/mcp.json.mcp.json
Network endpoints1
mcp.wix.com/sse
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest has no npm install lifecycle hooks; setup runs through the explicit project-creation CLI.
- Project creation invokes npx to add wix/skills with confirmation prompts suppressed, unless installation is skipped.
- MCP setup offers an IDE choice and a decline option, with configuration destinations inside the generated project.
- The generated MCP configuration launches unpinned @wix/mcp-remote through npx against https://mcp.wix.com/sse, allowing later launches to resolve another release.
- Dynamic function construction in the generator belongs to EJS template compilation.
- The inspected API-key request authenticates to the Wix backoffice client; no unrelated credential recipient was established.
Evidence against
- No concrete exfiltration, malicious persistence, or install-hook attack was identified.
- MCP configuration is gated by IDE selection and targets a Wix service.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystem
Source & flagged code
9 flaggedbuild/index.jsView file
105__commonJS,
L106: __dirname,
L107: __esm,
...
L751: {
L752: name: "AppVeyor",
L753: constant: "APPVEYOR",
...
L1074: var vendors = require_vendors();
L1075: var env4 = process.env;
L1076: Object.defineProperty(exports, "_vendors", {
...
L1310: }
L1311: process26.exitCode = code || /* istanbul ignore next */
L1312: 0;
Critical
Download Execute
Source downloads or fetches remote code and executes it.
build/index.jsView on unpkg · L105105Trigger-reachable chain: manifest.bin -> bin/index.cjs -> bin/import.cjs -> build/index.js
L105: __commonJS,
L106: __dirname,
L107: __esm,
...
L751: {
L752: name: "AppVeyor",
L753: constant: "APPVEYOR",
...
L1074: var vendors = require_vendors();
L1075: var env4 = process.env;
L1076: Object.defineProperty(exports, "_vendors", {
...
L1310: }
L1311: process26.exitCode = code || /* istanbul ignore next */
L1312: 0;
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
build/index.jsView on unpkg · L10519105"node:buffer": [">= 14.18 && < 15", ">= 16"],
L19106: child_process: true,
L19107: "node:child_process": [">= 14.18 && < 15", ">= 16"],
Findings
2 Critical6 High4 Medium5 Low
CriticalDownload Executebuild/index.js
CriticalTrigger Reachable Dangerous Capabilitybuild/index.js
HighChild Processbuild/index.js
HighEvalbuild/generator-F5VOTQAF.js
HighCredential Redirect Persistencebuild/index.js
HighCommand Output Exfiltrationbuild/index.js
HighCross File Remote Execution Contextbuild/index.js
HighSemantic Analysis Limitedbuild/generator-F5VOTQAF.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulebuild/yoga.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to @wix/create-app@0.0.260.
See all versions of @wix/create-app for other recorded verdicts.
- Review the evidence and your use of @wix/create-app@0.0.260 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.