registry / nexfep / 0.4.4

nexfep@0.4.4

A desktop application framework based on @webviewjs/webview

AI Security Review

scanned 5h ago · by lpm-firewall-ai

The explicit build command can invoke shell commands. Its output-path option is inserted unquoted into the `npx` shell command, creating a local command-injection risk for attacker-controlled CLI arguments.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `nexfep build` with a crafted `--output` value.

Impact

Arbitrary commands may run with the invoking user's privileges.

Mechanism

Shell interpolation in the build CLI

Rationale

Source inspection finds no malicious lifecycle hook or covert payload. The unquoted shell interpolation is nevertheless a concrete local command-execution vulnerability in an explicit build path.

Evidence

package.jsoncli/index.mjscli/build.mjscli/help.mjssrc/WindowManager.jssrc/Logger.jsnode_modulesdist/nexfpack.config.json

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

`cli/build.mjs` runs `npx --yes nexfpack@0.4.2` through a shell.

nexfep@0.4.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code