@workweave/router@0.2.31
One-command installer that points Claude Code, Codex, opencode, or pi at the Weave Router. For pi it also ships the routing extension, loaded via pi.extensions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package has no install lifecycle hook, and its installer, router requests, and subprocess features are tied to user-run setup or the advertised routing and language-server functions. The scanner leads are consistent with those features, not evidence of malicious behavior.
Decision evidence
public snapshot- package.json declares only a prepack script, with no install lifecycle hook.
- bin.js dispatches to the installer or uninstaller when a user runs the CLI.
- The installer validates the router key against the configured router base URL.
- After a successful routing toggle, the installer reports only the action and client type to the installed router.
- The pi extension describes language-server installation as requiring a user's affirmative response.
Source & flagged code
5 flaggedPackage source references child process execution.
pi-router/src/lsp-client.tsView on unpkg · L8A single source file combines environment access, network access, and code or shell execution; review context before blocking.
windows.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @workweave/router@0.2.31.
See all versions of @workweave/router for other recorded verdicts.
- Review the evidence and your use of @workweave/router@0.2.31 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.