registry / @wraps.dev/cli / 3.12.0
@wraps.dev/cli@3.12.0
Deploy email, SMS, and CDN infrastructure to your AWS account with one command. Sets up SES with DKIM/SPF/DMARC, event processing, and history automatically.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe published package is a user-run AWS email, SMS, and CDN CLI with no install lifecycle and no self-install chain. Telemetry and the agent webhook stay on wraps.dev or a caller-set wraps API and do not show a hidden exfiltration or control-surface attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User execution of the wraps binary, or a later invocation of a deployed Lambda.
Impact
No unconsented credential theft, remote payload execution, persistence, or foreign agent-control write was found in the inspected entrypoints.
Mechanism
The CLI parses argv and talks to AWS and wraps.dev for the product the user requested. Lambda handlers process SES or inbound mail inside the account and optionally notify the configured wraps API.
AI rationale
The published package is a user-run AWS email, SMS, and CDN CLI with no install lifecycle and no self-install chain. Telemetry and the agent webhook stay on wraps.dev or a caller-set wraps API and do not show a hidden exfiltration or control-surface attack.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no preinstall, install, or postinstall hook; npm scripts are only local build and test commands, and the published bin is dist/cli.js.
- The CLI starts from process.argv only when a user runs the wraps binary; it does not execute on package install or import.
- Usage telemetry defaults to the first-party https://wraps.dev/api/telemetry endpoint and is skipped for CI, DO_NOT_TRACK, WRAPS_TELEMETRY_DISABLED, or a disabled local config.
- The inbound processor reads BUCKET_NAME and posts to the wraps.inbound EventBridge source inside the caller AWS account.
Evidence against
- Telemetry is on by default and can include an organization id from local auth config, but the auth token itself is not placed in the event body.
- The agent-enforcer Lambda can POST an email payload to a configured WRAPS_API_URL webhook, and that path runs only after the function is deployed and invoked.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEval
Source & flagged code
14 flaggeddist/cli.jsView file
19import { fileURLToPath } from "url";
L20: var getFilename, getDirname, __dirname;
L21: var init_esm_shims = __esm({
...
L31: function isCI() {
L32: if (process.env.CI === "true" || process.env.CI === "1") {
L33: return true;
...
L201: // src/utils/shared/aws-detection.ts
L202: import { execSync } from "child_process";
L203: import { existsSync, readdirSync, readFileSync } from "fs";
...
L267: const sts = new STSClient({ region: "us-east-1" });
L268: const identity = await sts.send(new GetCallerIdentityCommand({}));
L269: return identity.Account || null;
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L1919Trigger-reachable chain: manifest.main -> dist/cli.js
L19: import { fileURLToPath } from "url";
L20: var getFilename, getDirname, __dirname;
L21: var init_esm_shims = __esm({
...
L31: function isCI() {
L32: if (process.env.CI === "true" || process.env.CI === "1") {
L33: return true;
...
L201: // src/utils/shared/aws-detection.ts
L202: import { execSync } from "child_process";
L203: import { existsSync, readdirSync, readFileSync } from "fs";
...
L267: const sts = new STSClient({ region: "us-east-1" });
L268: const identity = await sts.send(new GetCallerIdentityCommand({}));
L269: return identity.Account || null;
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/cli.jsFindings
3 Critical8 High5 Medium8 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighCloud Metadata Accessdist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighSemantic Analysis Limiteddist/lambda/inbound-processor/index.js
MediumDynamic Require
Affected versions and remediation
This report applies to @wraps.dev/cli@3.12.0.
See all versions of @wraps.dev/cli for other recorded verdicts.
- Review the evidence and your use of @wraps.dev/cli@3.12.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.