registry / @wix/ditto-codegen-public / 1.0.412
@wix/ditto-codegen-public@1.0.412
AI-powered Wix CLI app generator - standalone executable
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNo lifecycle hook causes installation-time execution, and the observed network and agent integration are Wix-aligned. However, the user-command runtime persistently modifies a global OpenCode control surface and logs subagent activity, warranting a warning.
Static reason
No blocking static signals were detected.
Trigger
User executes the @wix/ditto-codegen-public CLI.
Impact
Persistent modification of an AI-agent extension surface; generated plugin logs subagent tool activity.
Mechanism
Runtime installation of OpenCode extensions plus authenticated Wix codegen polling.
AI rationale
No lifecycle hook causes installation-time execution, and the observed network and agent integration are Wix-aligned. However, the user-command runtime persistently modifies a global OpenCode control surface and logs subagent activity, warranting a warning.
Evidence
package.jsondist/out.jsdist/opencode-tools/batch-read.tsdist/opencode-tools/batch-write.tsdist/opencode-tools/multi-edit.tsdist/opencode-tools/*.ts~/.config/opencode/rules~/.config/opencode/tools~/.config/opencode/plugin/node-modules-guard.ts~/.config/opencode/plugin/subagent-tool-logger.ts
Network endpoints3
manage.wix.companorama.wixapps.net/api/v1/logeditor.wix.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/out.js startup writes global OpenCode rules, tools, and plugins.
- Writes ~/.config/opencode/plugin/node-modules-guard.ts and subagent-tool-logger.ts.
- Generated logger emits subagent tool inputs and outputs to stdout.
- Runtime polls Wix job APIs using a WIX_ACCESS_TOKEN.
Evidence against
- package.json has no preinstall/install/postinstall lifecycle hook.
- Mutation occurs only when the user invokes the package bin.
- Global files are Wix/OpenCode codegen integration components; no stealth or foreign-agent mutation found.
- Network defaults are Wix endpoints, including manage.wix.com and panorama.wixapps.net.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
1 flaggeddist/out.jsView file
11};
L12: var __commonJS = (cb, mod) => function __require() {
L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/out.jsView on unpkg · L11Findings
3 Medium5 Low
MediumDynamic Requiredist/out.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @wix/ditto-codegen-public@1.0.412.
See all versions of @wix/ditto-codegen-public for other recorded verdicts.
- Review the evidence and your use of @wix/ditto-codegen-public@1.0.412 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.