registry / @wix/create-app / 0.0.277
@wix/create-app@0.0.277
Create Wix apps
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe package is a user-invoked Wix app creation CLI with no install lifecycle hook. The flagged process, dynamic-function, and network references resolve to CLI/template support and Wix reporting; the inspected telemetry censors API key and refresh token options.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes the package's CLI command.
Impact
No unauthorized account action, credential transfer, persistence, or remote code execution was established.
Mechanism
The launcher imports the CLI bundle; inspected telemetry censors API key and refresh token command options.
AI rationale
The package is a user-invoked Wix app creation CLI with no install lifecycle hook. The flagged process, dynamic-function, and network references resolve to CLI/template support and Wix reporting; the inspected telemetry censors API key and refresh token options.
Evidence
package.jsonbin/import.cjsbuild/chunk-SQF6ZNPR.jsbuild/index.jsbuild/esm-KPR2HWDF.jsbuild/generator-PYEX66NI.js
Network endpoints2
panorama.wixapps.net/api/v1/logwww.wixapis.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes bin/index.cjs and defines build, development, test, and typecheck scripts; it defines no install lifecycle hook.
- bin/import.cjs imports build/index.js as the CLI entrypoint.
- build/index.js configures Wix service URLs and the Wix Panorama reporting endpoint.
- Command telemetry censors apiKey and refreshToken options before reporting.
- The flagged child_process reference is in bundled process support; the dynamic Function reference is in a parser that checks the input is a function expression.
- The Sentry reporting observer is installed only when the platform supports it.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
9 flaggedbuild/chunk-SQF6ZNPR.jsView file
2405init_esm_shims();
L2406: var cp = __require("child_process");
L2407: var parse = require_parse();
High
Child Process
Package source references child process execution.
build/chunk-SQF6ZNPR.jsView on unpkg · L2405build/generator-PYEX66NI.jsView file
242exports.localsName = _DEFAULT_LOCALS_NAME;
L243: exports.promiseImpl = new Function("return this;")().Promise;
L244: exports.resolveInclude = function(name, filename, isDir) {
High
Eval
Package source references dynamic code evaluation.
build/generator-PYEX66NI.jsView on unpkg · L242•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
Findings
2 Critical6 High4 Medium5 Low
CriticalDownload Executebuild/index.js
CriticalTrigger Reachable Dangerous Capabilitybuild/index.js
HighChild Processbuild/chunk-SQF6ZNPR.js
HighEvalbuild/generator-PYEX66NI.js
HighCredential Redirect Persistencebuild/index.js
HighCommand Output Exfiltrationbuild/index.js
HighCross File Remote Execution Contextbuild/index.js
HighSemantic Analysis Limitedbuild/generator-PYEX66NI.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulebuild/yoga.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to @wix/create-app@0.0.277.
See all versions of @wix/create-app for other recorded verdicts.
- Review the evidence and your use of @wix/create-app@0.0.277 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.