wgc@0.129.7
The official CLI tool to manage the GraphQL Federation Platform Cosmo
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNo malicious install-time behavior, credential harvesting, or stealth persistence was found. The unverified remote-script bootstrap remains a user-invoked dangerous capability warranting a warning.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs `wgc router plugin generate` or `build` and accepts tool installation (or passes `--yes`/force); `init` scaffolds a plugin.
Impact
A changed remote script could execute with the invoking user's privileges; no unconsented install-time attack was found.
Mechanism
User-invoked remote shell bootstrap and scoped project scaffolding
AI rationale
No malicious install-time behavior, credential harvesting, or stealth persistence was found. The unverified remote-script bootstrap remains a user-invoked dangerous capability warranting a warning.
Evidence
package.jsondist/src/commands/router/commands/plugin/toolchain.jsdist/src/commands/router/commands/plugin/commands/generate.jsdist/src/commands/router/commands/plugin/commands/build.jsdist/src/commands/router/commands/plugin/commands/init.jsdist/src/core/telemetry.js.cursor/rules/plugin-development.mdc
Network endpoints3
raw.githubusercontent.com/wundergraph/cosmo/refs/tags/wgc%400.96.0/scripts/install-proto-tools.sheu.i.posthog.comcosmo-cp.wundergraph.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Unknown with low false-positive risk.
Evidence for warning
- dist/src/commands/router/commands/plugin/toolchain.js downloads a shell script with curl, chmods it, then executes it.
- The download-and-execute path is reachable from explicit `router plugin generate` and `build` commands.
- dist/src/commands/router/commands/plugin/commands/init.js writes a scoped .cursor/rules/plugin-development.mdc during explicit scaffolding.
Evidence against
- package.json has no npm lifecycle hooks.
- The remote script execution requires an explicit plugin build/generate command and normally a confirmation prompt.
- Docker commands are limited to the explicit `router plugin publish` workflow.
- Telemetry is opt-out and targets configured/package-aligned Cosmo/PostHog services; no broad file harvesting found.
- The dynamic require/eval hint is inert text embedded in a generated template patch.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
5 flaggeddist/src/core/plugin-publish.jsView file
7import { splitLabel } from '@wundergraph/cosmo-shared';
L8: import { execa } from 'execa';
L9: import { config, getBaseHeaders } from './config.js';
High
dist/src/commands/router/commands/plugin/templates/typescript.jsView file
4const dockerfile = 'FROM --platform=$BUILDPLATFORM oven/bun:1.3.0-alpine AS builder\n\n# Multi-platform build arguments\nARG TARGETOS\nARG TARGETARCH\n\nWORKDIR /build\n\n# Copy pa...
L5: const cursorRules = "---\ndescription: {name} Plugin Guide\nglobs: src/**\nalwaysApply: false\n---\n\n# {name} Plugin Development Guide\n\nYou are an expert in developing Cosmo Rou...
L6: const debugBuild = '#!/bin/sh\nDIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)\n\nWG_BUN_DEBUG="true" exec bun --inspect run "$DIR/../src/plugin.ts" "$@" 2>>"$DIR/plugin_stderr.lo...
L7: const grpcHealthCheckFilePatch = "diff --git a/build/src/health.js b/build/src/health.js\nindex [redacted]..[redacted] 1...
L8: const packageJson = '{\n "name": "plugin-bun",\n "version": "1.0.0",\n "description": "gRPC Plugin us
High
Findings
4 High4 Medium6 Low
HighChild Process
HighShelldist/src/core/plugin-publish.js
HighSame File Env Network Executiondist/src/commands/router/commands/plugin/templates/typescript.js
HighSandbox Evasion Gated Capabilitydist/src/core/telemetry.js
MediumDynamic Requiredist/src/commands/router/commands/plugin/templates/typescript.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/src/commands/router/commands/plugin/templates/typescript.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to wgc@0.129.7.
See all versions of wgc for other recorded verdicts.
- Review the evidence and your use of wgc@0.129.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.