registry / @wix/create-app / 0.0.276
@wix/create-app@0.0.276
Create Wix apps
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe source supports a user-invoked Wix app generator, with no install lifecycle hook or confirmed credential redirection. The scanner's execution and network matches resolve to template tooling, Wix service clients, redacted command telemetry, and conditional Sentry behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes the create-app CLI.
Impact
No confirmed malicious effect or attack surface was established.
Mechanism
The CLI supports Wix service requests and optional Git-template generation; the inspected command runner sets shell execution to false.
AI rationale
The source supports a user-invoked Wix app generator, with no install lifecycle hook or confirmed credential redirection. The scanner's execution and network matches resolve to template tooling, Wix service clients, redacted command telemetry, and conditional Sentry behavior.
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with high false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI entry and has no preinstall, install, or postinstall hook.
- The generator accepts a Git template URL after checking that it is a Git URL; its command runner disables shell execution.
- The bundled HTTP client uses Wix service hosts.
- Command telemetry censors apiKey and refreshToken flag values.
- The Sentry replay path returns without sending unless the client, transport, DSN, and sampled session are present.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
9 flaggedbuild/chunk-SQF6ZNPR.jsView file
2405init_esm_shims();
L2406: var cp = __require("child_process");
L2407: var parse = require_parse();
High
Child Process
Package source references child process execution.
build/chunk-SQF6ZNPR.jsView on unpkg · L2405build/generator-PYEX66NI.jsView file
242exports.localsName = _DEFAULT_LOCALS_NAME;
L243: exports.promiseImpl = new Function("return this;")().Promise;
L244: exports.resolveInclude = function(name, filename, isDir) {
High
Eval
Package source references dynamic code evaluation.
build/generator-PYEX66NI.jsView on unpkg · L242•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
Findings
2 Critical6 High4 Medium5 Low
CriticalDownload Executebuild/index.js
CriticalTrigger Reachable Dangerous Capabilitybuild/index.js
HighChild Processbuild/chunk-SQF6ZNPR.js
HighEvalbuild/generator-PYEX66NI.js
HighCredential Redirect Persistencebuild/index.js
HighCommand Output Exfiltrationbuild/index.js
HighCross File Remote Execution Contextbuild/index.js
HighSemantic Analysis Limitedbuild/generator-PYEX66NI.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulebuild/yoga.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to @wix/create-app@0.0.276.
See all versions of @wix/create-app for other recorded verdicts.
- Review the evidence and your use of @wix/create-app@0.0.276 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.