registry / wicked-interactive / 0.6.0

wicked-interactive@0.6.0

Interactive HTML & Presentation Builder with an in-browser feedback loop for business users.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

GitDependency

scanned 33 file(s), 435 KB of source, external domains: reactjs.org, stripe.com, wicked-reads.app, www.w3.org

Source & flagged code

5 flagged

bin/wicked-interactive.jsView file

Lines 3-43javascript

3//

4// wicked-interactive serve [--root <docs-dir>] [--port N] [--daemon] [--restart]

5// Multi-document mode (ADR-0015). Hosts every workspace under <docs-dir>; new docs are

6// created from the UI. The control plane is wicked-bus (ADR-0019).

7//

8// ONE SHARED INSTANCE by default (ADR-0022 amended). With no --root, every session uses the

9// canonical root ~/wicked-interactive/docs — so `serve --daemon` from any session REUSES the one

10// running bridge instead of spawning another on a different port (the "why is it on 5 ports"

11// confusion). Pass --root only when you deliberately want a SEPARATE, isolated instance.

12//

13// Ports, identity & the bridge (ADR-0022). The port is DYNAMIC (no --port → first free from

14// 4400 up; --port N is a preference that falls forward if taken). Each root records its live

15// bridge in <root>/.wi-serve.json. Reuse is IDENTITY-aware: we hit the recorded port's

16// /api/health (retried while the recorded pid is alive, so a busy daemon is reused, not

17// duplicated) and only reuse if it reports THIS root. Distinct roots never collide.

18//

19// --daemon self-detaches: spawns the server in the background (survives the launching shell/agent

20// call — no nohup/disown), waits until the bridge answers, prints the URL, exits 0. `--restart`

21// stops an existing daemon for the root first (clean upgrade); plain re-run reuses the live one.

23import { readFileSync, openSync, mkdirSync } from "node:fs";

24import { spawn } from "node:child_process";

25import { resolve, join } from "node:path";

High

Child Process

Package source references child process execution.

bin/wicked-interactive.jsView on unpkg · L23

26import { homedir } from "node:os";

27import { fileURLToPath } from "node:url";

28import { createMultiServer } from "../src/service/server.js";

29import {

30 readLock, writeLock, removeLock, pidAlive, pickPort, bridgeIdentity, stopDaemon,

31} from "../src/service/serve-bridge.mjs";

32import { registerInstance, deregisterInstance } from "../src/service/instances.mjs";

34const HERE = fileURLToPath(new URL(".", import.meta.url));

35const SELF = fileURLToPath(import.meta.url);

36const sleep = (ms) => new Promise((r) => setTimeout(r, ms));

38function parseArgs(argv) {

39 const args = { _: [] };

40 for (let i = 0; i < argv.length; i++) {

41 const a = argv[i];

42 if (!a.startsWith("--")) { args._.push(a); continue; }

43 const key = a.slice(2);

bin/ensure-siblings.mjsView file

Lines 1-64javascript

1#!/usr/bin/env node

2// ensure-siblings.mjs — set up the helper tools wicked-interactive needs (ADR-0016).

3//

4// Run once at startup by the `serve` skill. For each MISSING sibling it runs the real

5// install command — transparently: every command is printed before it runs, so the user

6// always sees exactly what's happening on their machine. Nothing is installed silently.

7//

8// node bin/ensure-siblings.mjs # auto-install anything missing

9// node bin/ensure-siblings.mjs --check # report only, install nothing

10// WI_NO_AUTOINSTALL=1 node … # same as --check (opt out of auto-install)

src/service/theme-grab.jsView file

Lines 1-33javascript

1// theme-grab.js — the deterministic, model-free "grab a URL to a PDF" primitive

2// (the service half of "learn a theme from a URL", ADR-0010/ADR-0020).

3//

4// Judgment (reading the captured design — palette, type scale, spacing, card treatment) is the

5// AGENT's job and lives in the assist skill. This module does NOTHING intelligent: it points a

6// headless browser at a LIVE https URL and prints it to PDF — the same `chrome --print-to-pdf`

7// primitive export.js uses for a version's HTML, only the final argument is the live URL instead

8// of `file://<html>`. We REUSE export.js's findChrome() so chrome discovery (and the WI_CHROME

9// override / clear "no Chrome found" error) stays in one place.

10//

vendor/pptx/html_to_pptx.pyView file

•path = vendor/pptx/html_to_pptx.py kind = build_helper sizeBytes = 6408 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vendor/pptx/html_to_pptx.pyView on unpkg

Source & flagged code

5 flagged · loading source

bin/wicked-interactive.jsView file

23import { readFileSync, openSync, mkdirSync } from "node:fs"; L24: import { spawn } from "node:child_process"; L25: import { resolve, join } from "node:path";

High

Child Process

Package source references child process execution.

bin/wicked-interactive.jsView on unpkg · L23

bin/ensure-siblings.mjsView file

44console.log(` $ ${cmd}`); L45: return spawnSync(cmd, { stdio: "inherit", shell: true }).status === 0; L46: }

High

Shell

Package source references shell execution.

bin/ensure-siblings.mjsView on unpkg · L44

11// L12: // Cross-platform: spawnSync(..., { shell:true }) resolves `claude`/`npx` via PATH on L13: // macOS, Linux, and Windows. ... L22: const PLAYWRIGHT_STEPS = [ L23: "npm install playwright", L24: "npx playwright install",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/ensure-siblings.mjsView on unpkg · L11

src/service/theme-grab.jsView file

13// EVERY address for the host and reject if any is loopback, link-local (incl. the cloud metadata L14: // endpoint 169.254.169.254), private, ULA, CGNAT, or unspecified; (4) PIN the validated IP into L15: // Chrome via --host-resolver-rules so DNS can't be rebound between validation and fetch. This ... L19: // Chrome `--print-to-pdf` FOLLOWS HTTP redirects, so a 302 from a validated public host to L20: // `http://169.254.169.254/` (or any private host) was followed and the internal response rendered. L21: // To close the main-document redirect vector portably (no OS-specific egress sandbox), we walk the ... L32: L33: import { spawn } from "node:child_process"; L34: import { existsSync } from "node:fs"; L35: import { lookup } from "node:dns/promises"; L36: import { isIP } from "node:net"; ... L265: return new Promise((resolveP, reject) => {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/service/theme-grab.jsView on unpkg · L13

vendor/pptx/html_to_pptx.pyView file

•path = vendor/pptx/html_to_pptx.py kind = build_helper sizeBytes = 6408 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vendor/pptx/html_to_pptx.pyView on unpkg

Findings

4 High5 Medium4 Low

HighChild Processbin/wicked-interactive.js

HighShellbin/ensure-siblings.mjs

HighCloud Metadata Accesssrc/service/theme-grab.js

HighRuntime Package Installbin/ensure-siblings.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpervendor/pptx/html_to_pptx.py

MediumStructural Risk Force Deep Review

MediumGit Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

bin/wicked-interactive.jsView file

Lines 3-43javascript

3//

4// wicked-interactive serve [--root <docs-dir>] [--port N] [--daemon] [--restart]

5// Multi-document mode (ADR-0015). Hosts every workspace under <docs-dir>; new docs are

6// created from the UI. The control plane is wicked-bus (ADR-0019).

7//

8// ONE SHARED INSTANCE by default (ADR-0022 amended). With no --root, every session uses the

9// canonical root ~/wicked-interactive/docs — so `serve --daemon` from any session REUSES the one

10// running bridge instead of spawning another on a different port (the "why is it on 5 ports"

11// confusion). Pass --root only when you deliberately want a SEPARATE, isolated instance.

12//

13// Ports, identity & the bridge (ADR-0022). The port is DYNAMIC (no --port → first free from

14// 4400 up; --port N is a preference that falls forward if taken). Each root records its live

15// bridge in <root>/.wi-serve.json. Reuse is IDENTITY-aware: we hit the recorded port's

16// /api/health (retried while the recorded pid is alive, so a busy daemon is reused, not

17// duplicated) and only reuse if it reports THIS root. Distinct roots never collide.

18//

19// --daemon self-detaches: spawns the server in the background (survives the launching shell/agent

20// call — no nohup/disown), waits until the bridge answers, prints the URL, exits 0. `--restart`

21// stops an existing daemon for the root first (clean upgrade); plain re-run reuses the live one.

23import { readFileSync, openSync, mkdirSync } from "node:fs";

24import { spawn } from "node:child_process";

25import { resolve, join } from "node:path";

High

Child Process

Package source references child process execution.

bin/wicked-interactive.jsView on unpkg · L23

26import { homedir } from "node:os";

27import { fileURLToPath } from "node:url";

28import { createMultiServer } from "../src/service/server.js";

29import {

30 readLock, writeLock, removeLock, pidAlive, pickPort, bridgeIdentity, stopDaemon,

31} from "../src/service/serve-bridge.mjs";

32import { registerInstance, deregisterInstance } from "../src/service/instances.mjs";

34const HERE = fileURLToPath(new URL(".", import.meta.url));

35const SELF = fileURLToPath(import.meta.url);

36const sleep = (ms) => new Promise((r) => setTimeout(r, ms));

38function parseArgs(argv) {

39 const args = { _: [] };

40 for (let i = 0; i < argv.length; i++) {

41 const a = argv[i];

42 if (!a.startsWith("--")) { args._.push(a); continue; }

43 const key = a.slice(2);

bin/ensure-siblings.mjsView file

Lines 1-64javascript

1#!/usr/bin/env node

2// ensure-siblings.mjs — set up the helper tools wicked-interactive needs (ADR-0016).

3//

4// Run once at startup by the `serve` skill. For each MISSING sibling it runs the real

5// install command — transparently: every command is printed before it runs, so the user

6// always sees exactly what's happening on their machine. Nothing is installed silently.

7//

8// node bin/ensure-siblings.mjs # auto-install anything missing

9// node bin/ensure-siblings.mjs --check # report only, install nothing

10// WI_NO_AUTOINSTALL=1 node … # same as --check (opt out of auto-install)

src/service/theme-grab.jsView file

Lines 1-33javascript

1// theme-grab.js — the deterministic, model-free "grab a URL to a PDF" primitive

2// (the service half of "learn a theme from a URL", ADR-0010/ADR-0020).

3//

4// Judgment (reading the captured design — palette, type scale, spacing, card treatment) is the

5// AGENT's job and lives in the assist skill. This module does NOTHING intelligent: it points a

6// headless browser at a LIVE https URL and prints it to PDF — the same `chrome --print-to-pdf`

7// primitive export.js uses for a version's HTML, only the final argument is the live URL instead

8// of `file://<html>`. We REUSE export.js's findChrome() so chrome discovery (and the WI_CHROME

9// override / clear "no Chrome found" error) stays in one place.

10//

vendor/pptx/html_to_pptx.pyView file

•path = vendor/pptx/html_to_pptx.py kind = build_helper sizeBytes = 6408 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vendor/pptx/html_to_pptx.pyView on unpkg