Loading npm security reports…

wgc: Suspicious npm security report (Warn) | LPM Firewall

registry / wgc / 0.129.3

wgc@0.129.3

The official CLI tool to manage the GraphQL Federation Platform Cosmo

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 148 file(s), 655 KB of source, external domains: accounts.wundergraph.com, api.github.com, api.mintlifytrieve.com, cosmo-cdn.wundergraph.com, cosmo-cp.wundergraph.com, cosmo-docs.wundergraph.com, cosmo.wundergraph.com, docs.docker.com, eu.i.posthog.com, github.com, leaves.mintlify.com, raw.githubusercontent.com, registry.npmjs.org, wundergraph.com

Source & flagged code

5 flagged

dist/src/core/plugin-publish.jsView file

Lines 1-27javascript

1import { readFile } from 'node:fs/promises';

2import { existsSync } from 'node:fs';

3import { arch, platform } from 'node:os';

4import path from 'node:path';

5import { EnumStatusCode } from '@wundergraph/cosmo-connect/dist/common/common_pb';

6import { SubgraphType } from '@wundergraph/cosmo-connect/dist/platform/v1/platform_pb';

7import { splitLabel } from '@wundergraph/cosmo-shared';

8import { execa } from 'execa';

9import { config, getBaseHeaders } from './config.js';

High

Shell

Package source references shell execution.

dist/src/core/plugin-publish.jsView on unpkg · L7

10export function getDefaultPlatforms() {

11 const supportedPlatforms = ['linux/amd64', 'linux/arm64', 'darwin/amd64', 'darwin/arm64', 'windows/amd64'];

12 const defaultPlatforms = ['linux/amd64', 'linux/arm64'];

13 const currentPlatform = platform();

14 const currentArch = arch();

15 let dockerPlatform = null;

16 switch (currentPlatform) {

17 case 'linux': {

18 if (currentArch === 'x64') {

19 dockerPlatform = 'linux/amd64';

20 }

21 else if (currentArch === 'arm64') {

22 dockerPlatform = 'linux/arm64';

23 }

24 break;

25 }

26 case 'darwin': {

27 if (currentArch === 'x64') {

dist/src/commands/router/commands/plugin/templates/typescript.jsView file

Lines 1-28javascript

1// Templates for typescript (templating is done by pupa)

2// This file is auto-generated. Do not edit manually.

3/* eslint-disable no-template-curly-in-string */

4const dockerfile = 'FROM --platform=$BUILDPLATFORM oven/bun:1.3.0-alpine AS builder\n\n# Multi-platform build arguments\nARG TARGETOS\nARG TARGETARCH\n\nWORKDIR /build\n\n# Copy package files

dist/src/core/telemetry.jsView file

Lines 1-29javascript

1import crypto from 'node:crypto';

2import os from 'node:os';

3import { PostHog } from 'posthog-node';

4import { EnumStatusCode } from '@wundergraph/cosmo-connect/dist/common/common_pb';

Source & flagged code

5 flagged · loading source

dist/src/core/plugin-publish.jsView file

7import { splitLabel } from '@wundergraph/cosmo-shared'; L8: import { execa } from 'execa'; L9: import { config, getBaseHeaders } from './config.js';

High

Shell

Package source references shell execution.

dist/src/core/plugin-publish.jsView on unpkg · L7

dist/src/commands/router/commands/plugin/templates/typescript.jsView file

4const dockerfile = 'FROM --platform=$BUILDPLATFORM oven/bun:1.3.0-alpine AS builder\n\n# Multi-platform build arguments\nARG TARGETOS\nARG TARGETARCH\n\nWORKDIR /build\n\n# Copy pa... L5: const cursorRules = "---\ndescription: {name} Plugin Guide\nglobs: src/**\nalwaysApply: false\n---\n\n# {name} Plugin Development Guide\n\nYou are an expert in developing Cosmo Rou... L6: const debugBuild = '#!/bin/sh\nDIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)\n\nWG_BUN_DEBUG="true" exec bun --inspect run "$DIR/../src/plugin.ts" "$@" 2>>"$DIR/plugin_stderr.lo... L7: const grpcHealthCheckFilePatch = "diff --git a/build/src/health.js b/build/src/health.js\nindex [redacted]..[redacted] 1... L8: const packageJson = '{\n "name": "plugin-bun",\n "version": "1.0.0",\n "description": "gRPC Plugin using Bun runtime",\n "type": "module",\n "scripts": {\n "build": "bun bu... ... L11: const pluginTs = "import * as grpc from '@grpc/grpc-js';\nimport { PluginServer } from './plugin-server';\n\n// Import generated gRPC code\nimport { \n {serviceName}Service, \n I... L12: const protobufjsInquirePatch = 'diff --git a/index.js b/index.

Findings

4 High4 Medium6 Low

HighChild Process

HighShelldist/src/core/plugin-publish.js

HighSame File Env Network Executiondist/src/commands/router/commands/plugin/templates/typescript.js

HighSandbox Evasion Gated Capabilitydist/src/core/telemetry.js

MediumDynamic Requiredist/src/commands/router/commands/plugin/templates/typescript.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/src/commands/router/commands/plugin/templates/typescript.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

5 flagged

dist/src/core/plugin-publish.jsView file

Lines 1-27javascript

1import { readFile } from 'node:fs/promises';

2import { existsSync } from 'node:fs';

3import { arch, platform } from 'node:os';

4import path from 'node:path';

5import { EnumStatusCode } from '@wundergraph/cosmo-connect/dist/common/common_pb';

6import { SubgraphType } from '@wundergraph/cosmo-connect/dist/platform/v1/platform_pb';

7import { splitLabel } from '@wundergraph/cosmo-shared';

8import { execa } from 'execa';

9import { config, getBaseHeaders } from './config.js';

High

Shell

Package source references shell execution.

dist/src/core/plugin-publish.jsView on unpkg · L7

10export function getDefaultPlatforms() {

11 const supportedPlatforms = ['linux/amd64', 'linux/arm64', 'darwin/amd64', 'darwin/arm64', 'windows/amd64'];

12 const defaultPlatforms = ['linux/amd64', 'linux/arm64'];

13 const currentPlatform = platform();

14 const currentArch = arch();

15 let dockerPlatform = null;

16 switch (currentPlatform) {

17 case 'linux': {

18 if (currentArch === 'x64') {

19 dockerPlatform = 'linux/amd64';

20 }

21 else if (currentArch === 'arm64') {

22 dockerPlatform = 'linux/arm64';

23 }

24 break;

25 }

26 case 'darwin': {

27 if (currentArch === 'x64') {

dist/src/commands/router/commands/plugin/templates/typescript.jsView file

Lines 1-28javascript

1// Templates for typescript (templating is done by pupa)

2// This file is auto-generated. Do not edit manually.

3/* eslint-disable no-template-curly-in-string */

4const dockerfile = 'FROM --platform=$BUILDPLATFORM oven/bun:1.3.0-alpine AS builder\n\n# Multi-platform build arguments\nARG TARGETOS\nARG TARGETARCH\n\nWORKDIR /build\n\n# Copy package files

dist/src/core/telemetry.jsView file

Lines 1-29javascript

1import crypto from 'node:crypto';

2import os from 'node:os';

3import { PostHog } from 'posthog-node';

4import { EnumStatusCode } from '@wundergraph/cosmo-connect/dist/common/common_pb';