registry / @workweave/router / 0.2.32
@workweave/router@0.2.32
One-command installer that points Claude Code, Codex, opencode, or pi at the Weave Router. For pi it also ships the routing extension, loaded via pi.extensions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged process execution and network access are consistent with a router installer and its optional desktop proxy. The reviewed lifecycle event request is limited to a routing action and harness and goes to the installed router endpoint.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The installer runs when the user invokes the package command; desktop proxy setup is selected with the claude-desktop target.
Impact
The configured router receives intended model requests and the router key; no unrelated collection or unauthorized account action was found.
Mechanism
The installer configures routing to the selected Weave Router endpoint. The optional desktop shim routes Claude Desktop and Cowork Messages API requests there and forwards other hosts directly.
AI rationale
The flagged process execution and network access are consistent with a router installer and its optional desktop proxy. The reviewed lifecycle event request is limited to a routing action and harness and goes to the installed router endpoint.
Evidence
install.shuninstall.shdesktop-shim.jsbin.jspi-router/src/lsp-client.ts
Network endpoints2
router.weaveos.comapi.anthropic.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a router installer and exposes install and uninstall commands.
- The launcher selects install.sh or uninstall.sh based on the user's --uninstall argument.
- The desktop shim sends matching Desktop or Cowork requests to the configured router and adds the router key header.
- The desktop proxy setup runs in the explicit claude-desktop install path.
- Lifecycle events are reported after a routing toggle, with the installed router endpoint and only action and harness fields in the request body.
- The LSP subprocess uses the supplied command and arguments with shell disabled.
Evidence against
- The package can spawn shell scripts, launch an LSP process, and install a login service for the Claude Desktop proxy.
- The desktop proxy terminates TLS for api.anthropic.com traffic and forwards matching Messages API requests to the configured router.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
5 flaggedpi-router/src/lsp-client.tsView file
8L9: import { spawn as nodeSpawn, type ChildProcess, type SpawnOptions } from "node:child_process";
L10: import * as path from "node:path";
High
Child Process
Package source references child process execution.
pi-router/src/lsp-client.tsView on unpkg · L8windows.jsView file
1#!/usr/bin/env node
L2: // Native Windows entrypoint. PowerShell users do not need Git Bash, jq, or
L3: // another installation beyond the npx command they already ran.
...
L13:
L14: const defaultBaseUrl = process.env.WEAVE_ROUTER_URL || "https://router.weaveos.com";
L15: const packageName = process.env.WEAVE_ROUTER_NPM_PACKAGE || "@weave-os/router";
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
windows.jsView on unpkg · L1bin.jsView file
Findings
4 High4 Medium4 Low
HighChild Processpi-router/src/lsp-client.ts
HighSame File Env Network Executionwindows.js
HighSandbox Evasion Gated Capabilitybin.js
HighPrevious Version Dangerous Deltadesktop-shim.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperuninstall.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @workweave/router@0.2.32.
See all versions of @workweave/router for other recorded verdicts.
- Review the evidence and your use of @workweave/router@0.2.32 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.