wave3d-agent-sdk@0.2.32: Suspicious npm security report (Warn)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 1 file(s), 676 KB of source, external domains: 127.0.0.1, json-schema.org, www.wave3d.ai

Source & flagged code

7 flagged

dist/cli.jsView file

2/*! NOTICE-ID: WAVE-ENGINE-PROPRIETARY-NOTICE-v1 | Wave Engine Copyright (c) 2026 Wave3D. Proprietary; not open source. Licensed use only. No reverse engineering, decompilation, di... L3: var define_WAVE_ENGINE_AGENT_SDK_LEGAL_default={noticeId:"WAVE-ENGINE-PROPRIETARY-NOTICE-v1",aiPolicyId:"WAVE-ENGINE-AI-POLICY-v1",classification:"proprietary-free-to-use-not-open-... L4: `);var WAVE_MCP_AUTHORING_GLOBALS_GUIDE=["Wave Studio bare authoring globals, common examples only:","- This guide is a compact memory aid, not an exhaustive list. Engine authoring...

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L2

2/*! NOTICE-ID: WAVE-ENGINE-PROPRIETARY-NOTICE-v1 | Wave Engine Copyright (c) 2026 Wave3D. Proprietary; not open source. Licensed use only. No reverse engineering, decompilation, di... L3: var define_WAVE_ENGINE_AGENT_SDK_LEGAL_default={noticeId:"WAVE-ENGINE-PROPRIETARY-NOTICE-v1",aiPolicyId:"WAVE-ENGINE-AI-POLICY-v1",classification:"proprietary-free-to-use-not-open-... L4: `);var WAVE_MCP_AUTHORING_GLOBALS_GUIDE=["Wave Studio bare authoring globals, common examples only:","- This guide is a compact memory aid, not an exhaustive list. Engine authoring... ... L14: `);import{createHash}from"node:crypto";import{existsSync}from"node:fs";import{readFile}from"node:fs/promises";import{homedir}from"node:os";import path from"node:path";import MiniSe... L15: ${JSON.stringify(decorated,null,2)}`:JSON.stringify(decorated,null,2)}function isRecord2(value){return!!value&&typeof value=="object"&&!Array.isArray(value)}function createJsonRpcR... L16: `)}function buildObjectModelTemplate(input){let partRecords=input.requiredParts.map((partName,order)=>{let partId=sanitizeObjectModelId(partName),meshId=`mesh_${partId}`;return{id:...

High

Source & flagged code

7 flagged · loading source

dist/cli.jsView file

2/*! NOTICE-ID: WAVE-ENGINE-PROPRIETARY-NOTICE-v1 | Wave Engine Copyright (c) 2026 Wave3D. Proprietary; not open source. Licensed use only. No reverse engineering, decompilation, di... L3: var define_WAVE_ENGINE_AGENT_SDK_LEGAL_default={noticeId:"WAVE-ENGINE-PROPRIETARY-NOTICE-v1",aiPolicyId:"WAVE-ENGINE-AI-POLICY-v1",classification:"proprietary-free-to-use-not-open-... L4: `);var WAVE_MCP_AUTHORING_GLOBALS_GUIDE=["Wave Studio bare authoring globals, common examples only:","- This guide is a compact memory aid, not an exhaustive list. Engine authoring...

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L2

2/*! NOTICE-ID: WAVE-ENGINE-PROPRIETARY-NOTICE-v1 | Wave Engine Copyright (c) 2026 Wave3D. Proprietary; not open source. Licensed use only. No reverse engineering, decompilation, di... L3: var define_WAVE_ENGINE_AGENT_SDK_LEGAL_default={noticeId:"WAVE-ENGINE-PROPRIETARY-NOTICE-v1",aiPolicyId:"WAVE-ENGINE-AI-POLICY-v1",classification:"proprietary-free-to-use-not-open-... L4: `);var WAVE_MCP_AUTHORING_GLOBALS_GUIDE=["Wave Studio bare authoring globals, common examples only:","- This guide is a compact memory aid, not an exhaustive list. Engine authoring... ... L14: `);import{createHash}from"node:crypto";import{existsSync}from"node:fs";import{readFile}from"node:fs/promises";import{homedir}from"node:os";import path from"node:path";import MiniSe... L15: ${JSON.stringify(decorated,null,2)}`:JSON.stringify(decorated,null,2)}function isRecord2(value){return!!value&&typeof value=="object"&&!Array.isArray(value)}function createJsonRpcR... L16: `)}function buildObjectModelTemplate(input){let partRecords=input.requiredParts.map((partName,order)=>{let partId=sanitizeObjectModelId(partName),meshId=`mesh_${partId}`;return{id:...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L2

386`,"utf8");let paths={outputDir,manifestPath,promptsPath};if(input.png){let texturePath=path3.join(outputDir,input.textureFileName);await writeFile2(texturePath,input.png),paths.tex... L387: `,files=await writeAtlasFiles({args,png,manifest,promptsMarkdown,textureFileName,manifestFileName});return{result:{ok:!0,mode:"compose",tool:"generate_wave_material_atlas",atlasKin... L388: `?(line+=1,column=1):column+=1;return{line,column}}function sk[redacted](code,startIndex,quote){let index=startIndex+1,escaped=!1;for(;index<code.length;){let current=c... ... L401: `),socket.destroy())}),await new Promise((resolve,reject)=>{server.once("error",reject),server.listen(port,host,()=>{server.off("error",reject),resolve()})}),logger.log(`[WaveEngin... L402: `)}function isSafePathSegment(value){return/^[A-Za-z0-9._-]+$/.test(value)}function requireSafePathSegment(value,label){if(!isSafePathSegment(value))throw new Error(`${label} conta... L403: "`]):execProcessIdCommand("lsof",["-nP",`-tiTCP:${port}`,"-sTCP:LISTEN"])}async function readProcessInfo(pid){if(pid===process.pid)return null;try{if(process.platform==="win32"){le...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L386

2/*! NOTICE-ID: WAVE-ENGINE-PROPRIETARY-NOTICE-v1 | Wave Engine Copyright (c) 2026 Wave3D. Proprietary; not open source. Licensed use only. No reverse engineering, decompilation, di... L3: var define_WAVE_ENGINE_AGENT_SDK_LEGAL_default={noticeId:"WAVE-ENGINE-PROPRIETARY-NOTICE-v1",aiPolicyId:"WAVE-ENGINE-AI-POLICY-v1",classification:"proprietary-free-to-use-not-open-... L4: `);var WAVE_MCP_AUTHORING_GLOBALS_GUIDE=["Wave Studio bare authoring globals, common examples only:","- This guide is a compact memory aid, not an exhaustive list. Engine authoring... L5: `);var WAVE_ENGINE_PROPRIETARY_AI_RULE="Wave Engine is free-to-use proprietary software, not open source or source available. Author user Experiences only through documented public... L6: `),WAVE_MCP_CODING_GUARDRAIL_SUMMARY=["Wave Studio MCP compact guardrails:",`0. ${WAVE_ENGINE_PROPRIETARY_AI_RULE}`,"1. Author WaveStudio user code only; avoid engine internals, pr... ... L14: `);import{createHash}from"node:crypto";import{existsSync}from"node:fs";import{readFile}from"node:fs/promises";import{homedir}from"node:os";import path from"node:path";import MiniSe... L15: ${JSON.stringify(decorated,null,2)}`:JSON.stringify(decorated,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L2

dist/sdk/wave-engine-sdk-2026-07-11.1.vxRP9BlrvhTb8JyqUd9L3DJ1ERpq18X9.zipView file

•path = dist/sdk/wave-engine-sdk-2026-07-11.1.[redacted].zip kind = high_entropy_blob sizeBytes = 1917651 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/sdk/wave-engine-sdk-2026-07-11.1.vxRP9BlrvhTb8JyqUd9L3DJ1ERpq18X9.zipView on unpkg

•path = dist/sdk/wave-engine-sdk-2026-07-11.1.[redacted].zip kind = compressed_blob sizeBytes = 1917651 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/sdk/wave-engine-sdk-2026-07-11.1.vxRP9BlrvhTb8JyqUd9L3DJ1ERpq18X9.zipView on unpkg

•path = dist/sdk/wave-engine-sdk-2026-07-11.1.[redacted].zip kind = nested_archive_needs_inspection sizeBytes = 1917651 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/sdk/wave-engine-sdk-2026-07-11.1.vxRP9BlrvhTb8JyqUd9L3DJ1ERpq18X9.zipView on unpkg

Findings

4 High4 Medium7 Low

HighChild Processdist/cli.js

HighSame File Env Network Executiondist/cli.js

HighCommand Output Exfiltrationdist/cli.js

HighShips High Entropy Blobdist/sdk/wave-engine-sdk-2026-07-11.1.vxRP9BlrvhTb8JyqUd9L3DJ1ERpq18X9.zip

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobdist/sdk/wave-engine-sdk-2026-07-11.1.vxRP9BlrvhTb8JyqUd9L3DJ1ERpq18X9.zip

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/cli.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiondist/sdk/wave-engine-sdk-2026-07-11.1.vxRP9BlrvhTb8JyqUd9L3DJ1ERpq18X9.zip

LowNo License