@wraps.dev/cli@3.4.0
Deploy email, SMS, and CDN infrastructure to your AWS account with one command. Sets up SES with DKIM/SPF/DMARC, event processing, and history automatically.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is not malicious by the install-time boundary, but its explicit command writes package-defined Claude Code context by default. Policy classifies this as a warn-level AI-agent capability.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs `wraps email templates init` without `--no-claude`.
Impact
Modifies a project AI-agent control surface with package-defined instructions and a skill.
Mechanism
Explicit project AI-agent context scaffolding.
AI rationale
The package is not malicious by the install-time boundary, but its explicit command writes package-defined Claude Code context by default. Policy classifies this as a warn-level AI-agent capability.
Evidence
package.jsondist/cli.js.claude/CLAUDE.md.claude/skills/wraps-templates/SKILL.md
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- `wraps email templates init` invokes Claude context scaffolding by default.
- The scaffolder creates or replaces project `.claude/CLAUDE.md` content and writes a `.claude/skills/wraps-templates/SKILL.md` file.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The mutation is reachable only through the explicit templates-init CLI command; no credential exfiltration to an unrelated endpoint was confirmed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings
CopyleftLicense
Source & flagged code
15 flaggeddist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @wraps.dev/cli@2.25.1
matchedIdentity = npm:QHdyYXBzLmRldi9jbGk:2.25.1
similarity = 0.818
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg201// src/utils/shared/aws-detection.ts
L202: import { execSync } from "child_process";
L203: import { existsSync, readdirSync, readFileSync } from "fs";
High
28275try {
L28276: await execAsync("pulumi version");
L28277: return true;
High
19
Findings
1 Critical11 High6 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCredential Exfiltrationdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighEntrypoint Foreign Package Code Overwritedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighCloud Metadata Accessdist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighSemantic Analysis Limiteddist/lambda/inbound-processor/index.js
Affected versions and remediation
This report applies to @wraps.dev/cli@3.4.0.
See all versions of @wraps.dev/cli for other recorded verdicts.
- Review the evidence and your use of @wraps.dev/cli@3.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.