@wraps.dev/cli@3.17.2
Deploy email, SMS, and CDN infrastructure to your AWS account with one command. Sets up SES with DKIM/SPF/DMARC, event processing, and history automatically.
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe CLI has a concrete credential-forwarding risk when an operator configures `WRAPS_API_URL` to an unrelated endpoint while a saved session exists. The inspected agent configuration write is explicit project scaffolding, and the manifest has no install hook; the evidence supports a warning, not a publish block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs a CLI operation that uses the agent API client while `WRAPS_API_URL` is set and a saved session token is available.
Impact
The operator-selected destination may receive a Wraps session credential, allowing its holder to use that credential within its permissions.
Mechanism
The URL override suppresses saved-instance selection, but token resolution can still fall back to saved authentication; the client sends the token in a bearer authorization header to the chosen API base.
AI rationale
The CLI has a concrete credential-forwarding risk when an operator configures `WRAPS_API_URL` to an unrelated endpoint while a saved session exists. The inspected agent configuration write is explicit project scaffolding, and the manifest has no install hook; the evidence supports a warning, not a publish block.
Evidence
dist/cli.js
Network endpoints1
api.wraps.dev
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- `WRAPS_API_URL` disables saved-instance selection while an existing saved authentication token remains eligible.
- The agent API client sends that token as a bearer credential to the selected API base; the override does not bind the token to the Wraps service.
- The CLI also scaffolds package-owned Claude Code context during an explicit project setup command, with a `noClaude` opt-out.
Evidence against
- The manifest has no install lifecycle hook; its scripts are development, build, and test commands.
- The default API and app endpoints are Wraps domains, and sign-in uses the Wraps app endpoint.
- The indicated Claude Code write is guarded by a command option and adds marked Wraps project context. It is not an install-time mutation of a broad agent control surface.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
14 flaggeddist/cli.jsView file
19import { fileURLToPath } from "url";
L20: var getFilename, getDirname, __dirname;
L21: var init_esm_shims = __esm({
...
L31: function isCI() {
L32: if (process.env.CI === "true" || process.env.CI === "1") {
L33: return true;
...
L316: // src/utils/shared/aws-detection.ts
L317: import { execSync } from "child_process";
L318: import { existsSync, readdirSync, readFileSync } from "fs";
...
L382: const sts = new STSClient({ region: "us-east-1" });
L383: const identity = await sts.send(new GetCallerIdentityCommand({}));
L384: return identity.Account || null;
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L1919Trigger-reachable chain: manifest.main -> dist/cli.js
L19: import { fileURLToPath } from "url";
L20: var getFilename, getDirname, __dirname;
L21: var init_esm_shims = __esm({
...
L31: function isCI() {
L32: if (process.env.CI === "true" || process.env.CI === "1") {
L33: return true;
...
L316: // src/utils/shared/aws-detection.ts
L317: import { execSync } from "child_process";
L318: import { existsSync, readdirSync, readFileSync } from "fs";
...
L382: const sts = new STSClient({ region: "us-east-1" });
L383: const identity = await sts.send(new GetCallerIdentityCommand({}));
L384: return identity.Account || null;
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/cli.jsFindings
2 Critical8 High5 Medium8 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighCloud Metadata Accessdist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighSemantic Analysis Limiteddist/lambda/inbound-processor/index.js
MediumDynamic Requiredist/lambda/agent-enforcer/index.js
MediumNetwork
Affected versions and remediation
This report applies to @wraps.dev/cli@3.17.2.
See all versions of @wraps.dev/cli for other recorded verdicts.
- Review the evidence and your use of @wraps.dev/cli@3.17.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.