registry / @wix/create-app / 0.0.279
@wix/create-app@0.0.279
Create Wix apps
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe manifest, CLI entrypoint, required bundle paths, authentication flow, template retrieval, command runner, and telemetry path were inspected. The scanner hints resolve to ordinary CLI behavior and Wix service reporting, with no confirmed attack surface.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running the CLI starts the bundled application; the manifest defines no install lifecycle hook.
Impact
No source evidence showed credentials sent to an unrelated recipient or unauthorized system changes.
Mechanism
The inspected authentication uses Wix service endpoints, template retrieval requires a valid Git URL, and the shared command runner disables shell execution.
AI rationale
The manifest, CLI entrypoint, required bundle paths, authentication flow, template retrieval, command runner, and telemetry path were inspected. The scanner hints resolve to ordinary CLI behavior and Wix service reporting, with no confirmed attack surface.
Network endpoints2
www.wixapis.companorama.wixapps.net/api/v1/log
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to a CLI binary and has no install lifecycle hook.
- The binary imports the bundled CLI entrypoint.
- The API key login flow uses a Wix client endpoint to retrieve account details.
- Template cloning validates a Git URL and clones it into a temporary directory.
- The shared command runner disables shell execution.
- Telemetry posts event payloads to Wix Panorama.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
9 flaggedbuild/chunk-SQF6ZNPR.jsView file
2405init_esm_shims();
L2406: var cp = __require("child_process");
L2407: var parse = require_parse();
High
Child Process
Package source references child process execution.
build/chunk-SQF6ZNPR.jsView on unpkg · L2405build/generator-PYEX66NI.jsView file
242exports.localsName = _DEFAULT_LOCALS_NAME;
L243: exports.promiseImpl = new Function("return this;")().Promise;
L244: exports.resolveInclude = function(name, filename, isDir) {
High
Eval
Package source references dynamic code evaluation.
build/generator-PYEX66NI.jsView on unpkg · L242•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
Findings
2 Critical6 High4 Medium5 Low
CriticalDownload Executebuild/index.js
CriticalTrigger Reachable Dangerous Capabilitybuild/index.js
HighChild Processbuild/chunk-SQF6ZNPR.js
HighEvalbuild/generator-PYEX66NI.js
HighCredential Redirect Persistencebuild/index.js
HighCommand Output Exfiltrationbuild/index.js
HighCross File Remote Execution Contextbuild/index.js
HighSemantic Analysis Limitedbuild/generator-PYEX66NI.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulebuild/yoga.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to @wix/create-app@0.0.279.
See all versions of @wix/create-app for other recorded verdicts.
- Review the evidence and your use of @wix/create-app@0.0.279 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.