registry / @wix/create-app / 0.0.264
@wix/create-app@0.0.264
Create Wix apps
AI Security Review
scanned 23d ago · by lpm-firewall-aiThis is a user-invoked Wix app CLI with no npm install lifecycle hook. The inspected suspicious matches have package-aligned explanations, and I found no verified credential disclosure to an unrelated recipient or unconsented broad agent write.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The CLI runs when a user invokes it; optional MCP setup follows an IDE choice in the interactive flow.
Impact
No unrelated credential recipient or unconsented broad agent configuration change was established.
Mechanism
The inspected authentication path sends the supplied token to Wix account APIs and stores auth data locally. The selected MCP file path is inside the generated project.
AI rationale
This is a user-invoked Wix app CLI with no npm install lifecycle hook. The inspected suspicious matches have package-aligned explanations, and I found no verified credential disclosure to an unrelated recipient or unconsented broad agent write.
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and lists build, development, test, and typecheck scripts; it has no install lifecycle hook.
- The API key flow uses the supplied token for a Wix account request and saves authentication data locally; the configured service hosts are Wix domains.
- The interactive flow offers IDE choices, including no MCP setup, and maps the selected IDE to an MCP file inside the generated project.
- The unusual host in the Sentry utility is a dummy base used to parse relative URL query parameters; the Sentry browser SDK uses its configured CDN for script URLs.
- The app-generation path loads the EJS generator, whose dynamic function construction compiles template source during rendering.
- The flagged helper in the remaining chunk is the vendored variant library’s matcher.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
10 flaggedbuild/chunk-7CQFMPLD.jsView file
2405init_esm_shims();
L2406: var cp = __require("child_process");
L2407: var parse = require_parse();
High
Child Process
Package source references child process execution.
build/chunk-7CQFMPLD.jsView on unpkg · L2405build/generator-FBF2AVYP.jsView file
242exports.localsName = _DEFAULT_LOCALS_NAME;
L243: exports.promiseImpl = new Function("return this;")().Promise;
L244: exports.resolveInclude = function(name, filename, isDir) {
High
Eval
Package source references dynamic code evaluation.
build/generator-FBF2AVYP.jsView on unpkg · L242•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
Findings
3 Critical6 High4 Medium5 Low
CriticalDownload Executebuild/index.js
CriticalTrigger Reachable Dangerous Capabilitybuild/index.js
CriticalPrevious Version Dangerous Deltabuild/index.js
HighChild Processbuild/chunk-7CQFMPLD.js
HighEvalbuild/generator-FBF2AVYP.js
HighCredential Redirect Persistencebuild/index.js
HighCommand Output Exfiltrationbuild/index.js
HighCross File Remote Execution Contextbuild/index.js
HighSemantic Analysis Limitedbuild/generator-FBF2AVYP.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulebuild/yoga.wasm
Affected versions and remediation
This report applies to @wix/create-app@0.0.264.
See all versions of @wix/create-app for other recorded verdicts.
- Review the evidence and your use of @wix/create-app@0.0.264 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.