wind-agent-cli@1.43.0

⚠ Under review

A local-first web interface for AI coding agents

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The inspected postinstall behavior is limited to local compatibility patches, and plugin installation is explicitly invoked with lifecycle scripts disabled for plugin dependencies. A clean decision cannot be fully supported within the eight-citation limit because the required clean coverage lists 18 distinct paths, so manual review is required by the supplied coverage rule.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Package installation runs the postinstall fixes; plugin installation requires a separate request to the plugin install route.

Impact

The inspected behavior supports local compatibility fixes and explicit plugin setup; it does not establish credential theft, stealth persistence, or unconsented agent control-surface mutation.

Mechanism

The postinstall scripts adjust permissions on the bundled node-pty helper on macOS and apply a targeted Windows console-visibility patch to the installed Codex SDK. Plugin setup clones a supplied repository and runs npm install with scripts disabled.

AI rationale

Evidence

package.jsonscripts/fix-node-pty.jsscripts/fix-codex-sdk-windows-hide.jsdist-server/server/modules/plugins/plugin-registry.service.jsdist-server/server/modules/plugins/plugins.service.jsdist-server/server/modules/plugins/plugins.routes.js

Decision evidence

public snapshot

AI called this Manual Review at 84.0% confidence as Unknown with low false-positive risk.

AI review observations

The postinstall hook runs two local dependency fixes; it does not install or modify an agent configuration surface.
The Windows fix is platform-gated and narrowly patches the installed Codex SDK entrypoint to hide a subprocess console.
Plugin installation is reached through an explicit HTTP install route and accepts a caller-supplied HTTPS or Git URL.
Plugin dependency installation uses npm with lifecycle scripts disabled.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

Manifest

CopyleftLicense

scanned 699 file(s), 10.6 MB of source, external domains: 127.0.0.1, 169.254.169.254, another-project.test, api-gateway.cloudcli.ai, api.example.com, api.exemple.com, api.github.com, api.openai.com, bit.ly, browser-restarted.test, chevrotain.io, cloudcli.ai, cloudcli.example, codex.example.com, cursor.com, data-pipeline.cloudcli.ai, developer.mozilla.org, docs.anthropic.com, docs.docker.com, en.wikipedia.org, example.com, example.org, example.test, extension.test, fb.me, github.com, github.com.evil.example, global.example.com, langium.org, legacy.test, localhost.example.com, ml-trainer.cloudcli.ai, new-project.test, new.test, old.test, opencode.ai, opencode.example.com, other-window.test, push.example.test, radix-ui.com, reactjs.org, reactrouter.com, registry.npmjs.org, stuk.github.io, taskmaster.example.test, user.test, voice.example, web-frontend.cloudcli.ai, worker-restarted.test, www.i18next.com

Source & flagged code

39 flagged

package.jsonView file

•scripts.postinstall = node scripts/fix-node-pty.js && node scripts/fix-codex-sdk-windows-hide.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/fix-node-pty.js && node scripts/fix-codex-sdk-windows-hide.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/assets/index-BtB6njsO.jsView file

2patternName = github_pat severity = critical line = 2

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/assets/index-BtB6njsO.jsView on unpkg · L2

2patternName = github_pat severity = critical line = 2

Critical

Secret Pattern

GitHub personal access token in dist/assets/index-BtB6njsO.js

dist/assets/index-BtB6njsO.jsView on unpkg · L2

5patternName = github_pat severity = critical line = 5

Critical

Secret Pattern

GitHub personal access token in dist/assets/index-BtB6njsO.js

dist/assets/index-BtB6njsO.jsView on unpkg · L5

8patternName = github_pat severity = critical line = 8

Critical

Secret Pattern

GitHub personal access token in dist/assets/index-BtB6njsO.js

dist/assets/index-BtB6njsO.jsView on unpkg · L8

11patternName = github_pat severity = critical line = 11

Critical

Secret Pattern

GitHub personal access token in dist/assets/index-BtB6njsO.js

dist/assets/index-BtB6njsO.jsView on unpkg · L11

14patternName = github_pat severity = critical line = 14

Critical

Secret Pattern

GitHub personal access token in dist/assets/index-BtB6njsO.js

dist/assets/index-BtB6njsO.jsView on unpkg · L14

17patternName = github_pat severity = critical line = 17

Critical

Secret Pattern

GitHub personal access token in dist/assets/index-BtB6njsO.js

dist/assets/index-BtB6njsO.jsView on unpkg · L17

2patternName = generic_password severity = medium line = 2

Medium

Secret Pattern

Hardcoded password in dist/assets/index-BtB6njsO.js

dist/assets/index-BtB6njsO.jsView on unpkg · L2

5patternName = generic_password severity = medium line = 5

Medium

Secret Pattern

Hardcoded password in dist/assets/index-BtB6njsO.js

dist/assets/index-BtB6njsO.jsView on unpkg · L5

8patternName = generic_password severity = medium line = 8

Medium

Secret Pattern

Hardcoded password in dist/assets/index-BtB6njsO.js

dist/assets/index-BtB6njsO.jsView on unpkg · L8

11patternName = generic_password severity = medium line = 11

Medium

Secret Pattern

Hardcoded password in dist/assets/index-BtB6njsO.js

dist/assets/index-BtB6njsO.jsView on unpkg · L11

17patternName = generic_password severity = medium line = 17

Medium

Secret Pattern

Hardcoded password in dist/assets/index-BtB6njsO.js

dist/assets/index-BtB6njsO.jsView on unpkg · L17

dist-server/server/shared/claude-cli-path.jsView file

1import { execFileSync } from 'node:child_process'; L2: import fs from 'node:fs';

High

Child Process

Package source references child process execution.

dist-server/server/shared/claude-cli-path.jsView on unpkg · L1

dist/assets/vendor-data-DsEZeNPr.jsView file

3`+gt),tt&&(gt=_e(gt)),R&&Zt?P(gt):gt},K.setConfig=function(){let X=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{};xe(X),At=!0,Ft=t,Tt=x},K.clearConfig=function(){Jt=null... L4: \0`,Y+=u(z,2),Y+=B.magic,Y+=u(v,2),Y+=u(T,2),Y+=u(it.crc32,4),Y+=u(it.compressedSize,4),Y+=u(it.uncompressedSize,4),Y+=u(W.length,2),Y+=u(P.length,2),{fileRecord:g.LOCAL_FILE_HEADE...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/vendor-data-DsEZeNPr.jsView on unpkg · L3

dist-server/server/modules/auth/auth.module.jsView file

7// composition root narrows its CommonJS runtime surface before injecting it. L8: const require = createRequire(import.meta.url); L9: const bcrypt = require('bcrypt');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-server/server/modules/auth/auth.module.jsView on unpkg · L7

scripts/tests/browser-extension-connection.test.mjsView file

53return new Response(JSON.stringify(connectError ? { error: connectError } : { L54: success: true, data: { protocolVersion: 2, sessionId: 'bound-chrome', token: 'fixture-credential', scope: 'browser', name: 'Work Chrome', controller: 'agent' }, L55: }), { status: connectError ? 400 : 200 }); ... L68: async function openPopup() { L69: const dom = new JSDOM(html, { url: 'https://extension.test/popup.html' }); L70: let disposed = false;

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

scripts/tests/browser-extension-connection.test.mjsView on unpkg · L53

dist-server/server/modules/providers/list/cursor/cursor-sessions.provider.jsView file

106try { L107: return JSON.parse(trimmed); L108: } ... L172: const { default: Database } = await import('better-sqlite3'); L173: const cwdId = crypto.createHash('md5').update(projectPath || process.cwd()).digest('hex'); L174: const safeSessionId = sanitizeLeafDirectoryName(sessionId, 'cursor session id');

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist-server/server/modules/providers/list/cursor/cursor-sessions.provider.jsView on unpkg · L106

dist-server/server/index.jsView file

6Manifest entrypoint (manifest.main) carries capability families absent from dist/build output: environment+network L6: import os from 'os'; L7: import http from 'http'; L8: import express from 'express'; ... L35: import { configureWebPush } from './modules/notifications/index.js'; L36: const __dirname = getModuleDirectory(import.meta.url); L37: // The server source runs from /server, while the compiled output runs from /dist-server/server. ... L41: // Version of the code that is actually running, captured once at process L42: // startup. This intentionally does NOT re-read package.json per request: after L43: // an update replaces the files on disk, package.json reflects the NEW version ... L48: try { L49: return JSON.parse(fs.readFileSync(path.join(APP_ROOT, 'package.json'), 'utf8')).vers

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

dist-server/server/index.jsView on unpkg · L6

electron/main.jsView file

1import { app, BrowserWindow, clipboard, dialog, ipcMain, session, shell, webContents } from 'electron'; L2: import { spawn } from 'node:child_process'; L3: import path from 'node:path'; ... L12: L13: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L14: ... L18: const CALLBACK_URL = `${CALLBACK_PROTOCOL}://auth/callback`; L19: const CLOUDCLI_CONTROL_PLANE_URL = process.env.CLOUDCLI_CONTROL_PLANE_URL || 'https://cloudcli.ai'; L20: const REMOTE_START_TIMEOUT_MS = 30000; ... L24: L25: if (process.platform === 'win32') { L26: app.setAppUserModelId(APP_USER_MODEL_ID);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

electron/main.jsView on unpkg · L1

electron/localServer.jsView file

1Detached bundled service listener: electron/localServer.js spawns dist-server/server/index.js; helper exposes a broad-bound HTTP listener. L1: import { spawn } from 'node:child_process'; L2: import fs from 'node:fs/promises'; L3: import http from 'node:http'; L4: import net from 'node:net'; ... L15: const MAX_STARTUP_LOG_LINES = 300; L16: const SERVER_MARKER_PATH = path.join(os.homedir(), '.cloudcli', 'local-server.json'); L17: const LOCAL_SERVER_URL_ENV_KEYS = [ ... L41: ok: res.statusCode >= 200 && res.statusCode < 300, L42: json: JSON.parse(body), L43: }); ... L99: function getDesktopPath() { L100: const currentPath = process.env.PATH || '';

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

electron/localServer.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = electron/localServer.js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

electron/localServer.jsView on unpkg

scripts/generate-pwa-icons.ps1View file

•path = scripts/generate-pwa-icons.ps1 kind = build_helper sizeBytes = 71 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/generate-pwa-icons.ps1View on unpkg

dist/windcli-browser-bridge.zipView file

•path = dist/windcli-browser-bridge.zip kind = high_entropy_blob sizeBytes = 74560 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/windcli-browser-bridge.zipView on unpkg

•path = dist/windcli-browser-bridge.zip kind = compressed_blob sizeBytes = 74560 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/windcli-browser-bridge.zipView on unpkg

•path = dist/windcli-browser-bridge.zip kind = nested_archive_needs_inspection sizeBytes = 74560 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/windcli-browser-bridge.zipView on unpkg

dist-server/scripts/fix-codex-sdk-windows-hide.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 18

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist-server/scripts/fix-codex-sdk-windows-hide.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = dist-server/scripts/fix-codex-sdk-windows-hide.js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-server/scripts/fix-codex-sdk-windows-hide.jsView on unpkg

dist-server/server/modules/cli/cli.module.jsView file

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = dist-server/server/modules/cli/cli.module.js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-server/server/modules/cli/cli.module.jsView on unpkg

scripts/fix-codex-sdk-windows-hide.jsView file

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = scripts/fix-codex-sdk-windows-hide.js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/fix-codex-sdk-windows-hide.jsView on unpkg

dist-server/server/modules/database/connection.jsView file

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = dist-[redacted].js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-server/server/modules/database/connection.jsView on unpkg

dist-server/server/modules/database/tests/provider-models.db.integration.test.jsView file

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = dist-[redacted]-models.db.integration.test.js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-server/server/modules/database/tests/provider-models.db.integration.test.jsView on unpkg

dist-server/server/modules/plugins/plugin-process.service.jsView file

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = dist-[redacted]-process.service.js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-server/server/modules/plugins/plugin-process.service.jsView on unpkg

dist-server/server/modules/plugins/plugin-registry.service.jsView file

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = dist-[redacted]-registry.service.js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-server/server/modules/plugins/plugin-registry.service.jsView on unpkg

dist-server/server/modules/providers/list/claude/claude-auth.provider.jsView file

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = dist-[redacted]-auth.provider.js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-server/server/modules/providers/list/claude/claude-auth.provider.jsView on unpkg

dist-server/server/modules/providers/list/opencode/opencode-auth.provider.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-server/server/modules/providers/list/opencode/opencode-auth.provider.jsView on unpkg

dist-server/server/modules/cli/sandbox.service.jsView file

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = dist-[redacted].service.js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-server/server/modules/cli/sandbox.service.jsView on unpkg

dist-server/server/modules/projects/services/project-clone.service.jsView file

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = dist-[redacted]-clone.service.js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-server/server/modules/projects/services/project-clone.service.jsView on unpkg

Source & flagged code

39 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-node-pty.js && node scripts/fix-codex-sdk-windows-hide.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/fix-node-pty.js && node scripts/fix-codex-sdk-windows-hide.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/assets/index-BtB6njsO.jsView file

2patternName = github_pat severity = critical line = 2

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/assets/index-BtB6njsO.jsView on unpkg · L2

Findings

7 Critical20 High13 Medium10 Low

CriticalCritical Secretdist/assets/index-BtB6njsO.js

CriticalSecret Patterndist/assets/index-BtB6njsO.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist-server/server/shared/claude-cli-path.js

HighShell

HighEntrypoint Build Divergencedist-server/server/index.js

HighSandbox Evasion Gated Capability

Affected versions and remediation

This report applies to wind-agent-cli@1.43.0.

See all versions of wind-agent-cli for other recorded verdicts.

Review the evidence and your use of wind-agent-cli@1.43.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 17:09:13.814Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code