wgc@0.129.8
The official CLI tool to manage the GraphQL Federation Platform Cosmo
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
5 flaggeddist/src/core/plugin-publish.jsView file
7import { splitLabel } from '@wundergraph/cosmo-shared';
L8: import { execa } from 'execa';
L9: import { config, getBaseHeaders } from './config.js';
High
dist/src/commands/router/commands/plugin/templates/typescript.jsView file
4const dockerfile = 'FROM --platform=$BUILDPLATFORM oven/bun:1.3.0-alpine AS builder\n\n# Multi-platform build arguments\nARG TARGETOS\nARG TARGETARCH\n\nWORKDIR /build\n\n# Copy pa...
L5: const cursorRules = "---\ndescription: {name} Plugin Guide\nglobs: src/**\nalwaysApply: false\n---\n\n# {name} Plugin Development Guide\n\nYou are an expert in developing Cosmo Rou...
L6: const debugBuild = '#!/bin/sh\nDIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)\n\nWG_BUN_DEBUG="true" exec bun --inspect run "$DIR/../src/plugin.ts" "$@" 2>>"$DIR/plugin_stderr.lo...
L7: const grpcHealthCheckFilePatch = "diff --git a/build/src/health.js b/build/src/health.js\nindex [redacted]..[redacted] 1...
L8: const packageJson = '{\n "name": "plugin-bun",\n "version": "1.0.0",\n "description": "gRPC Plugin us
High
Findings
4 High4 Medium6 Low
HighChild Process
HighShelldist/src/core/plugin-publish.js
HighSame File Env Network Executiondist/src/commands/router/commands/plugin/templates/typescript.js
HighSandbox Evasion Gated Capabilitydist/src/core/telemetry.js
MediumDynamic Requiredist/src/commands/router/commands/plugin/templates/typescript.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/src/commands/router/commands/plugin/templates/typescript.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to wgc@0.129.8.
See all versions of wgc for other recorded verdicts.
- Review the evidence and your use of wgc@0.129.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.