wgc@0.132.1
The official CLI tool to manage the GraphQL Federation Platform Cosmo
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the suspicious agent-control finding is an explicit project scaffolder that writes generated templates. Telemetry is ordinary CLI usage reporting with opt-out support, so the inspected source does not establish an attack surface.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the CLI starts telemetry; running `wgc router plugin init` starts scaffolding.
Impact
No confirmed malicious effect or installation-time mutation was established.
Mechanism
Telemetry is disabled by supported opt-out variables. Scaffolding writes templates and project configuration in the user-selected project directory.
AI rationale
The manifest has no install lifecycle hook, and the suspicious agent-control finding is an explicit project scaffolder that writes generated templates. Telemetry is ordinary CLI usage reporting with opt-out support, so the inspected source does not establish an attack surface.
Evidence
package.jsondist/src/core/telemetry.jsdist/src/commands/router/commands/plugin/commands/init.jsdist/src/index.js
Network endpoints2
eu.i.posthog.comcosmo-cp.wundergraph.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines build and development scripts but no install lifecycle hook.
- Telemetry initializes from the CLI entrypoint and honors COSMO_TELEMETRY_DISABLED or DO_NOT_TRACK; this is ordinary usage telemetry.
- Plugin scaffolding is an explicit `init` command and creates project files within the selected directory.
- The flagged agent-related writes are generated plugin project templates, not automatic changes during installation.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
4 flaggeddist/src/core/telemetry.jsView file
9// Support for COSMO_TELEMETRY_DISABLED and Console Do Not Track standard
L10: const TELEMETRY_DISABLED = process.env.COSMO_TELEMETRY_DISABLED === 'true' || process.env.DO_NOT_TRACK === '1';
L11: const UNAUTHENTICATED_CONTEXT_METADATA = Object.freeze({ organizationId: 'anonymous' });
...
L20: // This will also make the retry mechanism ineffective.
L21: async function safePostHogFetch(url, options) {
L22: try {
...
L40: const isCI = () => {
L41: return Boolean(process.env.CI || // Travis CI, CircleCI, GitLab CI, GitHub Actions, etc.
L42: process.env.CONTINUOUS_INTEGRATION ||
...
L163: var _a;
L164: const machineId = crypto.hash('sha256', os.hostname(), 'hex');
L165: return {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/src/core/telemetry.jsView on unpkg · L960export const initTelemetry = () => {
if (TELEMETRY_DISABLED) {
return;
}
const posthogApiKey = process.env.POSTHOG_API_KEY || 'phc_CEnvoyw3KcTuC5E1seDPrgvAamgGRDLfzPi1e7RU1G1';
const posthogHost =
Low
Ai Review Evidence
Telemetry initializes from the CLI entrypoint and honors COSMO_TELEMETRY_DISABLED or DO_NOT_TRACK; this is ordinary usage telemetry.
dist/src/core/telemetry.jsView on unpkg · L60Findings
2 High3 Medium7 Low
HighSandbox Evasion Gated Capabilitydist/src/core/telemetry.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/src/commands/router/commands/plugin/commands/init.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/src/core/telemetry.js
Affected versions and remediation
This report applies to wgc@0.132.1.
See all versions of wgc for other recorded verdicts.
- Review the evidence and your use of wgc@0.132.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.