wgc@0.130.1
The official CLI tool to manage the GraphQL Federation Platform Cosmo
AI Security Review
scanned 25d ago · by lpm-firewall-aiSource inspection found no install-time lifecycle hook or concrete attack behavior. The scanner's plugin mutation finding is an explicitly invoked scaffold command, and the telemetry code is consistent with CLI usage analytics.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the CLI starts telemetry; running the plugin init command creates a scaffold in the selected directory.
Impact
No concrete malicious effect was established from the inspected source.
Mechanism
Telemetry sends usage events to PostHog unless disabled. The init command writes template files to the requested project location.
AI rationale
Source inspection found no install-time lifecycle hook or concrete attack behavior. The scanner's plugin mutation finding is an explicitly invoked scaffold command, and the telemetry code is consistent with CLI usage analytics.
Evidence
package.jsondist/package.jsondist/src/core/telemetry.jsdist/src/commands/router/commands/plugin/commands/init.jsdist/src/index.js
Network endpoints1
eu.i.posthog.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI entry point and has no preinstall, install, or postinstall hook.
- dist/package.json identifies the same CLI package and version.
- The plugin initializer is an explicit `init` command that scaffolds a user-selected project.
- Telemetry can be disabled and sends usage events to PostHog; the inspected code showed no credential forwarding or gated attack behavior.
Evidence against
- The scanner flagged plugin setup and telemetry, but the inspected initializer writes scaffold files only when its CLI command runs.
- Telemetry collects CLI metadata and identity for usage events; this is consistent with the package's CLI and does not establish an attack.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
4 flaggeddist/src/core/telemetry.jsView file
9// Support for COSMO_TELEMETRY_DISABLED and Console Do Not Track standard
L10: const TELEMETRY_DISABLED = process.env.COSMO_TELEMETRY_DISABLED === 'true' || process.env.DO_NOT_TRACK === '1';
L11: const UNAUTHENTICATED_CONTEXT_METADATA = Object.freeze({ organizationId: 'anonymous' });
...
L20: // This will also make the retry mechanism ineffective.
L21: async function safePostHogFetch(url, options) {
L22: try {
...
L40: const isCI = () => {
L41: return Boolean(process.env.CI || // Travis CI, CircleCI, GitLab CI, GitHub Actions, etc.
L42: process.env.CONTINUOUS_INTEGRATION ||
...
L163: var _a;
L164: const machineId = crypto.hash('sha256', os.hostname(), 'hex');
L165: return {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/src/core/telemetry.jsView on unpkg · L9dist/src/commands/router/commands/plugin/commands/init.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
}
}
const proto = compilegraphqltoproto(plugintemplates.schemagraphql, {
servicename,
packagename: 'service',
protooptions,
});
await writefile(resolve(generateddir, 'service.proto'), proto.proto);
await writefile(resolve(generateddir, 'service.proto.lock.json'), json.stringify(proto.lockdata, null, 2));
let readmetemplate = '';
let mainfilename = '';
await mkdir(resolve(tempdir, '.cursor', 'rules'), { recursive: true });
switch (options.lang
Findings
3 High3 Medium6 Low
HighSandbox Evasion Gated Capabilitydist/src/core/telemetry.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/src/commands/router/commands/plugin/commands/init.js
HighSemantic Analysis Limiteddist/package.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to wgc@0.130.1.
See all versions of wgc for other recorded verdicts.
- Review the evidence and your use of wgc@0.130.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.