@wix/ditto-codegen-public@1.0.446
AI-powered Wix CLI app generator - standalone executable
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe runtime provider path can forward a Wix token to an unrestricted endpoint when CODEGEN_AI_PROXY_BASE_URL is configured, which warrants a warning for conditional credential exposure. The default is a local proxy and the manifest has no install hook, so the source does not establish an install-time attack or malicious default recipient.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the CLI to process a job while CODEGEN_AI_PROXY_BASE_URL points to an endpoint outside the intended Wix proxy.
Impact
A Wix access token could be disclosed to an endpoint selected through the environment override.
Mechanism
The CLI places WIX_ACCESS_TOKEN in the provider's Bearer authorization header and passes that provider configuration to OpenCode; the proxy base URL has no host validation in the inspected source.
AI rationale
The runtime provider path can forward a Wix token to an unrestricted endpoint when CODEGEN_AI_PROXY_BASE_URL is configured, which warrants a warning for conditional credential exposure. The default is a local proxy and the manifest has no install hook, so the source does not establish an install-time attack or malicious default recipient.
Evidence
dist/out.js
Network endpoints1
localhost:3001
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exposes a CLI and declares only build and test scripts; it has no install hook.
- The job flow refreshes a Wix access token and sets it for use by the provider configuration.
- The AI proxy base URL can be set through CODEGEN_AI_PROXY_BASE_URL; its default is localhost, and the generated service URL includes the project ID.
- The provider configuration adds the Wix token as a Bearer authorization header for Anthropic and OpenAI requests.
- The CLI passes that provider configuration to the OpenCode process when running a job.
Evidence against
- The configured default is a local proxy, and the source describes the token as being used to authorize the project.
- The credential transfer occurs during runtime job processing, not through an install lifecycle hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/out.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @wix/ditto-codegen-public@1.0.456
matchedIdentity = npm:[redacted]:1.0.456
similarity = 0.900
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/out.jsView on unpkg10541exports2.refreshWixAccessToken = refreshWixAccessToken;
L10542: var child_process_1 = require("child_process");
L10543: var util_1 = require("util");
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/out.js:
// ../../node_modules/@[redacted].js
var require_authorization = __commonJS({
"../../node_modules/@[redacted].js"(exports2) {
exports2.authorization = authorization;
function authorization(signedInstance) {
authorization: signedInstance
var _authorization = require_authorization();
const headers = [(0, _xWixBrand.xWixBrand)(), (0, _consentPolicy.consentPolicy)(), (0, _authorization.authorization)(opts.signedInstance), (0, _artifactId.artifactId)(opts.artifact...
Findings
1 Critical3 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/out.js
HighChild Processdist/out.js
HighCredential Redirect Persistencedist/out.js
HighCommand Output Exfiltrationdist/out.js
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @wix/ditto-codegen-public@1.0.446.
See all versions of @wix/ditto-codegen-public for other recorded verdicts.
- Review the evidence and your use of @wix/ditto-codegen-public@1.0.446 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.