registry / @wix/ditto-codegen-public / 1.0.404
@wix/ditto-codegen-public@1.0.404
AI-powered Wix CLI app generator - standalone executable
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms a first-party agent-extension lifecycle and broad code-generation capability, with no lifecycle execution or demonstrated malicious exfiltration. Warn under the agent-extension policy.
Static reason
No blocking static signals were detected.
Trigger
User runs the package bin.
Impact
The invoked agent can alter the selected project and extends the user's OpenCode configuration; no install-time attack is present.
Mechanism
first-party AI-agent extension setup and authenticated code-generation orchestration
AI rationale
Source inspection confirms a first-party agent-extension lifecycle and broad code-generation capability, with no lifecycle execution or demonstrated malicious exfiltration. Warn under the agent-extension policy.
Evidence
package.jsondist/out.jsdist/opencode-tools/batch-write.tsdist/opencode-tools/multi-edit.tsdist/opencode-tools/validate.ts
Network endpoints3
manage.wix.comlocalhost:3001editor.wix.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/out.js executes its main loop when the bin is invoked.
- It writes OpenCode rules, tools, and a plugin under ~/.config/opencode.
- It spawns `opencode run` with agent permissions and an MCP command.
- It sends Wix-authenticated job requests to https://manage.wix.com.
Evidence against
- package.json has no preinstall/install/postinstall lifecycle hook.
- The behavior is triggered by explicit execution of dist/out.js.
- No source evidence of credential theft, unrelated exfiltration, or destructive payloads.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
1 flaggeddist/out.jsView file
11};
L12: var __commonJS = (cb, mod) => function __require() {
L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/out.jsView on unpkg · L11Findings
3 Medium5 Low
MediumDynamic Requiredist/out.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @wix/ditto-codegen-public@1.0.404.
See all versions of @wix/ditto-codegen-public for other recorded verdicts.
- Review the evidence and your use of @wix/ditto-codegen-public@1.0.404 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.