wgc@0.130.2
The official CLI tool to manage the GraphQL Federation Platform Cosmo
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a lifecycle-free CLI package whose flagged control-surface write is an explicit scaffold command. The remaining network and Docker behavior is feature-aligned and no concrete malicious chain was established.
Static reason
One or more suspicious static signals were detected.
Trigger
Running wgc commands, especially plugin initialization or publishing.
Impact
No unconsented install-time mutation, persistence, payload execution, or credential exfiltration was found.
Mechanism
User-invoked CLI scaffolding, publishing, authentication, and telemetry.
AI rationale
This is a lifecycle-free CLI package whose flagged control-surface write is an explicit scaffold command. The remaining network and Docker behavior is feature-aligned and no concrete malicious chain was established.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The CLI initializes telemetry at runtime and can send an authenticated email, organization ID, and hashed hostname.
- The plugin initializer writes Cursor rule files, but only after the user invokes the named plugin-init command.
- The package contains Docker child-process execution for an explicit plugin publishing workflow.
Evidence against
- package.json has no preinstall, install, or postinstall hook and no self-dependency.
- The Cursor files are generated as part of a user-requested plugin scaffold, not during installation.
- The flagged dynamic require/eval text is a generated template patch that replaces eval with require.
- Authentication requests target the configured WunderGraph identity service; no credential harvesting or unrelated exfiltration was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
7 flaggeddist/src/core/plugin-publish.jsView file
7import { splitLabel } from '@wundergraph/cosmo-shared';
L8: import { execa } from 'execa';
L9: import { config, getBaseHeaders } from './config.js';
High
dist/src/commands/router/commands/plugin/templates/typescript.jsView file
4const dockerfile = 'FROM --platform=$BUILDPLATFORM oven/bun:1.3.0-alpine AS builder\n\n# Multi-platform build arguments\nARG TARGETOS\nARG TARGETARCH\n\nWORKDIR /build\n\n# Copy pa...
L5: const cursorRules = "---\ndescription: {name} Plugin Guide\nglobs: src/**\nalwaysApply: false\n---\n\n# {name} Plugin Development Guide\n\nYou are an expert in developing Cosmo Rou...
L6: const debugBuild = '#!/bin/sh\nDIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)\n\nWG_BUN_DEBUG="true" exec bun --inspect run "$DIR/../src/plugin.ts" "$@" 2>>"$DIR/plugin_stderr.lo...
L7: const grpcHealthCheckFilePatch = "diff --git a/build/src/health.js b/build/src/health.js\nindex [redacted]..[redacted] 1...
L8: const packageJson = '{\n "name": "plugin-bun",\n "version": "1.0.0",\n "description": "gRPC Plugin us
High
Findings
6 High4 Medium6 Low
HighChild Process
HighShelldist/src/core/plugin-publish.js
HighSame File Env Network Executiondist/src/commands/router/commands/plugin/templates/typescript.js
HighSandbox Evasion Gated Capabilitydist/src/core/telemetry.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/src/commands/router/commands/plugin/commands/init.js
HighSemantic Analysis Limiteddist/package.json
MediumDynamic Requiredist/src/commands/router/commands/plugin/templates/typescript.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/src/commands/router/commands/plugin/templates/typescript.js
Affected versions and remediation
This report applies to wgc@0.130.2.
See all versions of wgc for other recorded verdicts.
- Review the evidence and your use of wgc@0.130.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.