registry / @wix/create-app / 0.0.274
@wix/create-app@0.0.274
Create Wix apps
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the launcher loads the CLI bundle. Inspected authentication targets Wix services, while the flagged file excerpts reflect bundled dependencies rather than confirmed attack behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running the CLI launcher; authentication requests occur when the user logs in.
Impact
No confirmed harmful effect or unauthorized credential transfer was established.
Mechanism
The launcher imports the bundled CLI. Device-code authentication requests and session storage are part of the Wix login flow.
AI rationale
The manifest has no install lifecycle hook, and the launcher loads the CLI bundle. Inspected authentication targets Wix services, while the flagged file excerpts reflect bundled dependencies rather than confirmed attack behavior.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies this as the Wix app creation CLI and points to bin/index.cjs.
- The manifest scripts show build, development, test, and typecheck commands; no install lifecycle hook is present.
- The launcher checks the Node version, applies a non-TTY rendering setting, and imports the CLI entrypoint.
- The inspected authentication flow sends device-code requests to Wix endpoints and saves the resulting session for later use.
- Flagged runtime files contain bundled CLI dependencies, Sentry CDN support, and EJS error handling; these excerpts show no attack behavior.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
9 flaggedbuild/chunk-SQF6ZNPR.jsView file
2405init_esm_shims();
L2406: var cp = __require("child_process");
L2407: var parse = require_parse();
High
Child Process
Package source references child process execution.
build/chunk-SQF6ZNPR.jsView on unpkg · L2405build/generator-PYEX66NI.jsView file
242exports.localsName = _DEFAULT_LOCALS_NAME;
L243: exports.promiseImpl = new Function("return this;")().Promise;
L244: exports.resolveInclude = function(name, filename, isDir) {
High
Eval
Package source references dynamic code evaluation.
build/generator-PYEX66NI.jsView on unpkg · L242•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
Findings
2 Critical6 High4 Medium5 Low
CriticalDownload Executebuild/index.js
CriticalTrigger Reachable Dangerous Capabilitybuild/index.js
HighChild Processbuild/chunk-SQF6ZNPR.js
HighEvalbuild/generator-PYEX66NI.js
HighCredential Redirect Persistencebuild/index.js
HighCommand Output Exfiltrationbuild/index.js
HighCross File Remote Execution Contextbuild/index.js
HighSemantic Analysis Limitedbuild/generator-PYEX66NI.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulebuild/yoga.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to @wix/create-app@0.0.274.
See all versions of @wix/create-app for other recorded verdicts.
- Review the evidence and your use of @wix/create-app@0.0.274 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.