@wix/create-app@0.0.281
Create Wix apps
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe credential-redirection and remote-execution hints were not substantiated. However, runtime telemetry is enabled by default and sends flow answers plus additional information to Wix without an apparent consent prompt, so this warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
When the CLI runs and reports flow-step answers while telemetry is enabled by default.
Impact
User-provided flow responses and related details may be reported without an in-command consent prompt; DO_NOT_TRACK=1 disables telemetry.
Mechanism
The flow logger submits answer, question, question key, and serialized additional information through the Wix BI logger.
AI rationale
The credential-redirection and remote-execution hints were not substantiated. However, runtime telemetry is enabled by default and sends flow answers plus additional information to Wix without an apparent consent prompt, so this warrants a warning.
Evidence
build/index.js
Network endpoints1
frog.wix.com
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The user config enables telemetry by default.
- Setting DO_NOT_TRACK=1 disables telemetry.
- The CLI reports answers to its flow questions and serialized additional information.
- The default Wix BI logger endpoint is https://frog.wix.com.
Evidence against
- The manifest declares no lifecycle scripts; execution begins through the CLI bin entry.
- The source contains no confirmed credential redirection or unrelated remote-code execution.
- Telemetry has an opt-out through DO_NOT_TRACK=1.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
8 flaggedbuild/chunk-HUXGF57B.jsView file
2405init_esm_shims();
L2406: var cp = __require("child_process");
L2407: var parse = require_parse();
High
Child Process
Package source references child process execution.
build/chunk-HUXGF57B.jsView on unpkg · L2405build/generator-VOZ4TG6N.jsView file
1123if (ast.body[0].expression.body.type === "BlockStatement") {
L1124: return new Function(params, source.slice(body[0] + 1, body[1] - 1));
L1125: }
High
Eval
Package source references dynamic code evaluation.
build/generator-VOZ4TG6N.jsView on unpkg · L1123build/index.jsView file
106__commonJS,
L107: __dirname,
L108: __esm,
...
L752: {
L753: name: "AppVeyor",
L754: constant: "APPVEYOR",
...
L1075: var vendors = require_vendors();
L1076: var env5 = process.env;
L1077: Object.defineProperty(exports, "_vendors", {
...
L1311: }
L1312: process26.exitCode = code || /* istanbul ignore next */
L1313: 0;
Findings
2 Critical5 High4 Medium5 Low
CriticalDownload Executebuild/index.js
CriticalTrigger Reachable Dangerous Capabilitybuild/index.js
HighChild Processbuild/chunk-HUXGF57B.js
HighEvalbuild/generator-VOZ4TG6N.js
HighCredential Redirect Persistencebuild/index.js
HighCommand Output Exfiltrationbuild/index.js
HighCross File Remote Execution Contextbuild/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulebuild/yoga.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @wix/create-app@0.0.281.
See all versions of @wix/create-app for other recorded verdicts.
- Review the evidence and your use of @wix/create-app@0.0.281 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.