@workweave/router@0.2.35
One-command installer that points Claude Code, Codex, opencode, or pi at the Weave Router. For pi it also ships the routing extension, loaded via pi.extensions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe installer sends undisclosed telemetry after successful routing toggles, reporting the action and client type to the configured router. The behavior is limited to a user-triggered state change and does not expose host or project data, so it warrants a warning rather than a block.
Decision evidence
public snapshot- After a successful routing on/off change, install.sh sends a best-effort event containing the action and client harness to the configured router, authenticated with the router key.
- The event is not described in the README and has no visible opt-out.
- The package has no install lifecycle hook; its only npm script is prepack.
- The event is sent only after a user-requested routing toggle and uses the installed or explicitly configured router endpoint.
- The language-server installer is documented as opt-in and requires user confirmation.
Source & flagged code
5 flaggedPackage source references child process execution.
pi-router/src/lsp-client.tsView on unpkg · L8A single source file combines environment access, network access, and code or shell execution; review context before blocking.
windows.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @workweave/router@0.2.35.
See all versions of @workweave/router for other recorded verdicts.
- Review the evidence and your use of @workweave/router@0.2.35 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.