registry / @wix/ditto-codegen-public / 1.0.430
@wix/ditto-codegen-public@1.0.430
⚠ Under reviewAI-powered Wix CLI app generator - standalone executable
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flaggeddist/out.jsView file
134L135: // ../../node_modules/dotenv/package.json
L136: var require_package = __commonJS({
...
L170: },
L171: homepage: "https://github.com/motdotla/dotenv#readme",
L172: funding: "https://dotenvx.com",
...
L236: function supportsAnsi() {
L237: return process.stdout.isTTY;
L238: }
...
L267: if (!result.parsed) {
L268: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`);
L269: err.code = "MISSING_DATA";
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/out.jsView on unpkg · L134134Trigger-reachable chain: manifest.bin -> dist/out.js
L134:
L135: // ../../node_modules/dotenv/package.json
L136: var require_package = __commonJS({
...
L170: },
L171: homepage: "https://github.com/motdotla/dotenv#readme",
L172: funding: "https://dotenvx.com",
...
L236: function supportsAnsi() {
L237: return process.stdout.isTTY;
L238: }
...
L267: if (!result.parsed) {
L268: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`);
L269: err.code = "MISSING_DATA";
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/out.jsView on unpkg · L134Findings
3 Critical1 High3 Medium5 Low
CriticalCommand Output Exfiltrationdist/out.js
CriticalTrigger Reachable Dangerous Capabilitydist/out.js
CriticalPrevious Version Dangerous Deltadist/out.js
HighChild Processdist/out.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @wix/ditto-codegen-public@1.0.430.
See all versions of @wix/ditto-codegen-public for other recorded verdicts.
- Review the evidence and your use of @wix/ditto-codegen-public@1.0.430 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.