@wix/ditto-codegen-public@1.0.471
AI-powered Wix CLI app generator - standalone executable
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe package has no install lifecycle hook, and the inspected credential forwarding occurs at runtime. Since the configurable destinations are not restricted to approved hosts, conditional credential exposure remains a warning-level risk rather than a confirmed malicious transfer.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A runtime AI job or code-generation service request while an environment URL override points to an unintended recipient.
Impact
Conditional exposure of the Wix token to the configured recipient; the inspected source does not establish a package-selected remote recipient.
Mechanism
The CLI builds provider destinations from an environment variable and attaches the current Wix token to provider request headers; it does not restrict the override to approved hosts.
AI rationale
The package has no install lifecycle hook, and the inspected credential forwarding occurs at runtime. Since the configurable destinations are not restricted to approved hosts, conditional credential exposure remains a warning-level risk rather than a confirmed malicious transfer.
Evidence
dist/out.js
Network endpoints2
localhost:3001manage.wix.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes a CLI entry and has build and test scripts but no install lifecycle hook.
- The CLI can obtain a Wix access token, and provider requests can include it as a bearer credential.
- Provider destinations are built from an environment-configurable proxy URL with a localhost default; the source does not restrict overrides to approved hosts.
- The generated provider configuration and child process use that destination during AI jobs; the code-generation server also accepts an environment-configurable base URL for bearer-authenticated requests.
Evidence against
- The configured defaults point to localhost and Wix’s manage service, rather than a package-selected unrelated remote host.
- The feedback tool sends a Wix token to a Wix endpoint only after its report-content checks pass.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
5 flaggeddist/out.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @wix/ditto-codegen-public@1.0.456
matchedIdentity = npm:[redacted]:1.0.456
similarity = 0.900
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/out.jsView on unpkg10554exports2.refreshWixAccessToken = refreshWixAccessToken;
L10555: var child_process_1 = require("child_process");
L10556: var util_1 = require("util");
High
16044var logger_12 = require_logger();
L16045: var execAsync = (0, util_1.promisify)(child_process_1.exec);
L16046: var CLI_TIMEOUT_MS = 15e3;
High
Findings
1 Critical4 High2 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/out.js
HighChild Processdist/out.js
HighShelldist/out.js
HighCredential Redirect Persistencedist/out.js
HighCommand Output Exfiltrationdist/out.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @wix/ditto-codegen-public@1.0.471.
See all versions of @wix/ditto-codegen-public for other recorded verdicts.
- Review the evidence and your use of @wix/ditto-codegen-public@1.0.471 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.