@wix/create-app@0.0.280
Create Wix apps
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package performs runtime telemetry to Wix's own endpoint and includes command arguments and non-censored flag values. This may expose identifying or sensitive input, so the behavior merits a warning; the reviewed credential flow targets Wix services.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
When the CLI command starts.
Impact
Arguments or non-censored flag values could contain identifying or sensitive data.
Mechanism
The command-start event includes raw command arguments and sanitized flags, with only apiKey and refreshToken flag names censored; it is sent to the Wix telemetry endpoint.
AI rationale
The package performs runtime telemetry to Wix's own endpoint and includes command arguments and non-censored flag values. This may expose identifying or sensitive input, so the behavior merits a warning; the reviewed credential flow targets Wix services.
Evidence
build/index.jsCLI auth data file (path resolved by getApiKeyAuthDataFilePath())
Network endpoints6
frog.wix.commanage.wix.comeditor.wix.comcode.wix.comwww.wix.comwww.wixapis.com
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI reports command arguments and flags in its command-start telemetry; only apiKey and refreshToken flags are censored.
- The telemetry logger defaults to Wix's frog.wix.com endpoint.
- The package is a Wix app creation CLI and exposes bin/index.cjs as its executable.
Evidence against
- The manifest has no install lifecycle scripts.
- Wix API destinations are Wix-owned hosts.
- API key auth data is read from the CLI's auth file and used in a Wix account request.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
9 flaggedbuild/chunk-HUXGF57B.jsView file
2405init_esm_shims();
L2406: var cp = __require("child_process");
L2407: var parse = require_parse();
High
Child Process
Package source references child process execution.
build/chunk-HUXGF57B.jsView on unpkg · L2405build/generator-A447FITL.jsView file
242exports.localsName = _DEFAULT_LOCALS_NAME;
L243: exports.promiseImpl = new Function("return this;")().Promise;
L244: exports.resolveInclude = function(name, filename, isDir) {
High
Eval
Package source references dynamic code evaluation.
build/generator-A447FITL.jsView on unpkg · L242•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
Findings
2 Critical6 High4 Medium5 Low
CriticalDownload Executebuild/index.js
CriticalTrigger Reachable Dangerous Capabilitybuild/index.js
HighChild Processbuild/chunk-HUXGF57B.js
HighEvalbuild/generator-A447FITL.js
HighCredential Redirect Persistencebuild/index.js
HighCommand Output Exfiltrationbuild/index.js
HighCross File Remote Execution Contextbuild/index.js
HighSemantic Analysis Limitedbuild/generator-A447FITL.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulebuild/yoga.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to @wix/create-app@0.0.280.
See all versions of @wix/create-app for other recorded verdicts.
- Review the evidence and your use of @wix/create-app@0.0.280 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.