wind-agent-cli@1.43.1

⚠ Under review

A local-first web interface for AI coding agents

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Inspected source shows platform-scoped dependency fixes and an application plugin installer that disables npm lifecycle scripts. The required clean decision needs citations for 18 paths, exceeding the eight-citation limit, and no independent attack behavior was established to support a warning or block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

The package postinstall hook runs its platform-specific fixes; plugin installation is triggered through the application's install route.

Impact

No confirmed malicious effect was established in the inspected code; required clean-path citation coverage remains incomplete.

Mechanism

The inspected postinstall scripts modify bundled dependency files or permissions on their target platforms. The plugin installer receives a URL and disables dependency lifecycle scripts.

AI rationale

Evidence

package.jsonscripts/fix-node-pty.jsscripts/fix-codex-sdk-windows-hide.jsdist-server/server/modules/plugins/plugin-registry.service.jsdist-server/server/modules/plugins/plugins.routes.js

Decision evidence

public snapshot

AI called this Manual Review at 87.0% confidence as Unknown with medium false-positive risk.

AI review observations

The postinstall hook invokes two package scripts; one adjusts a bundled node-pty helper on macOS and the other patches the bundled Codex SDK on Windows.
The plugin install function takes a URL, and its route passes the request URL to that function.
Plugin installation uses npm with lifecycle scripts disabled.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

Manifest

CopyleftLicense

scanned 699 file(s), 10.6 MB of source, external domains: 127.0.0.1, 169.254.169.254, another-project.test, api-gateway.cloudcli.ai, api.example.com, api.exemple.com, api.github.com, api.openai.com, bit.ly, browser-restarted.test, chevrotain.io, cloudcli.ai, cloudcli.example, codex.example.com, cursor.com, data-pipeline.cloudcli.ai, developer.mozilla.org, docs.anthropic.com, docs.docker.com, en.wikipedia.org, example.com, example.org, example.test, extension.test, fb.me, github.com, github.com.evil.example, global.example.com, langium.org, legacy.test, localhost.example.com, ml-trainer.cloudcli.ai, new-project.test, new.test, old.test, opencode.ai, opencode.example.com, other-window.test, push.example.test, radix-ui.com, reactjs.org, reactrouter.com, registry.npmjs.org, stuk.github.io, taskmaster.example.test, user.test, voice.example, web-frontend.cloudcli.ai, worker-restarted.test, www.i18next.com

Source & flagged code

39 flagged

package.jsonView file

Lines 48-88json

48 "desktop:dist:win": "npm run build && npm run desktop:stage && electron-builder --projectDir .desktop-build/desktop-app --win nsis",

49 "server:bundle": "npm run build && node scripts/release/build-server-bundle.js",

50 "desktop:icon:mac": "node electron/scripts/generate-macos-icon.js",

51 "assets:brand": "node scripts/generate-brand-assets.mjs",

52 "build": "npm run build:client && npm run build:server",

53 "build:client": "node scripts/package-browser-extension.mjs && node scripts/build-client.mjs && node scripts/verify-pwa-build.mjs",

54 "prebuild:server": "node -e \"require('node:fs').rmSync('dist-server.next', { recursive: true, force: true })\"",

55 "build:server": "tsc -p server/tsconfig.json && tsc-alias -p server/tsconfig.json",

56 "postbuild:server": "node scripts/promote-dist-server.mjs",

57 "preview": "vite preview",

58 "typecheck": "tsc --noEmit -p tsconfig.json && tsc --noEmit -p server/tsconfig.json",

59 "test": "tsx --tsconfig server/tsconfig.json --test \"server/**/*.test.ts\" \"server/**/*.test.js\"",

60 "test:client": "tsx --test \"src/**/*.test.ts\" \"src/**/*.test.tsx\" && npm run test:browser-extension",

61 "test:browser-extension": "node --test scripts/tests/browser-extension-*.test.mjs",

62 "test:desktop-updater": "node --test scripts/tests/desktop-updater.test.mjs",

63 "lint": "eslint src/ server/ --max-warnings=0",

64 "lint:fix": "eslint src/ server/ --fix",

65 "start": "npm run build && npm run server",

66 "release": "./release.sh",

67 "prepublishOnly": "npm run build",

68 "postinstall": "node scripts/fix-node-pty.js && node scripts/fix-codex-sdk-windows-hide.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L68

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L68

69 "prepare": "husky",

70 "update:platform": "./update-platform.sh",

71 "audit:production": "npm audit --omit=dev --audit-level=low",

72 "audit:all": "npm audit --audit-level=low"

73 },

74 "build": {

75 "appId": "ai.cloudcli.desktop",

76 "productName": "WindCli",

77 "asar": false,

78 "artifactName": "windcli-desktop-${version}-${os}-${arch}.${ext}",

79 "directories": {

80 "output": "release/desktop"

81 },

82 "extraMetadata": {

83 "main": "electron/main.js"

84 },

85 "publish": {

86 "provider": "github",

87 "owner": "CaineWind",

88 "repo": "wacli"

dist/assets/index-C68Z1NRo.jsView file

2patternName = github_pat severity = critical line = 2

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/assets/index-C68Z1NRo.jsView on unpkg · L2

2patternName = github_pat severity = critical line = 2

Critical

Secret Pattern

GitHub personal access token in dist/assets/index-C68Z1NRo.js

dist/assets/index-C68Z1NRo.jsView on unpkg · L2

5patternName = github_pat severity = critical line = 5

Critical

Secret Pattern

GitHub personal access token in dist/assets/index-C68Z1NRo.js

dist/assets/index-C68Z1NRo.jsView on unpkg · L5

8patternName = github_pat severity = critical line = 8

Critical

Secret Pattern

GitHub personal access token in dist/assets/index-C68Z1NRo.js

dist/assets/index-C68Z1NRo.jsView on unpkg · L8

dist-server/server/shared/claude-cli-path.jsView file

1import { execFileSync } from 'node:child_process'; L2: import fs from 'node:fs';

High

Child Process

Package source references child process execution.

dist-server/server/shared/claude-cli-path.jsView on unpkg · L1

dist/assets/Shell-DOwuDicl.jsView file

1import{r as Y,j as X}from"./vendor-react-C2GTiUCy.js";import{ac as mt,ab as St,ag as at,g as $e}from"./feature-workspace-dgDF7R8A.js";import{L as Ve,v as ht,X as lt,bE as Ct,aw as ... L2: layout (location = 0) in vec2 a_unitquad;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/Shell-DOwuDicl.jsView on unpkg · L1

dist-server/server/modules/auth/auth.module.jsView file

7// composition root narrows its CommonJS runtime surface before injecting it. L8: const require = createRequire(import.meta.url); L9: const bcrypt = require('bcrypt');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-server/server/modules/auth/auth.module.jsView on unpkg · L7

scripts/tests/browser-extension-connection.test.mjsView file

53return new Response(JSON.stringify(connectError ? { error: connectError } : { L54: success: true, data: { protocolVersion: 2, sessionId: 'bound-chrome', token: 'fixture-credential', scope: 'browser', name: 'Work Chrome', controller: 'agent' }, L55: }), { status: connectError ? 400 : 200 }); ... L68: async function openPopup() { L69: const dom = new JSDOM(html, { url: 'https://extension.test/popup.html' }); L70: let disposed = false;

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

scripts/tests/browser-extension-connection.test.mjsView on unpkg · L53

dist-server/server/modules/providers/list/cursor/cursor-sessions.provider.jsView file

106try { L107: return JSON.parse(trimmed); L108: } ... L172: const { default: Database } = await import('better-sqlite3'); L173: const cwdId = crypto.createHash('md5').update(projectPath || process.cwd()).digest('hex'); L174: const safeSessionId = sanitizeLeafDirectoryName(sessionId, 'cursor session id');

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist-server/server/modules/providers/list/cursor/cursor-sessions.provider.jsView on unpkg · L106

dist-server/server/index.jsView file

6Manifest entrypoint (manifest.main) carries capability families absent from dist/build output: environment+network L6: import os from 'os'; L7: import http from 'http'; L8: import express from 'express'; ... L35: import { configureWebPush } from './modules/notifications/index.js'; L36: const __dirname = getModuleDirectory(import.meta.url); L37: // The server source runs from /server, while the compiled output runs from /dist-server/server. ... L41: // Version of the code that is actually running, captured once at process L42: // startup. This intentionally does NOT re-read package.json per request: after L43: // an update replaces the files on disk, package.json reflects the NEW version ... L48: try { L49: return JSON.parse(fs.readFileSync(path.join(APP_ROOT, 'package.json'), 'utf8')).vers

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

dist-server/server/index.jsView on unpkg · L6

electron/main.jsView file

1import { app, BrowserWindow, clipboard, dialog, ipcMain, session, shell, webContents } from 'electron'; L2: import { spawn } from 'node:child_process'; L3: import path from 'node:path'; ... L12: L13: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L14: ... L18: const CALLBACK_URL = `${CALLBACK_PROTOCOL}://auth/callback`; L19: const CLOUDCLI_CONTROL_PLANE_URL = process.env.CLOUDCLI_CONTROL_PLANE_URL || 'https://cloudcli.ai'; L20: const REMOTE_START_TIMEOUT_MS = 30000; ... L24: L25: if (process.platform === 'win32') { L26: app.setAppUserModelId(APP_USER_MODEL_ID);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

electron/main.jsView on unpkg · L1

electron/localServer.jsView file

1Detached bundled service listener: electron/localServer.js spawns dist-server/server/index.js; helper exposes a broad-bound HTTP listener. L1: import { spawn } from 'node:child_process'; L2: import fs from 'node:fs/promises'; L3: import http from 'node:http'; L4: import net from 'node:net'; ... L15: const MAX_STARTUP_LOG_LINES = 300; L16: const SERVER_MARKER_PATH = path.join(os.homedir(), '.cloudcli', 'local-server.json'); L17: const LOCAL_SERVER_URL_ENV_KEYS = [ ... L41: ok: res.statusCode >= 200 && res.statusCode < 300, L42: json: JSON.parse(body), L43: }); ... L99: function getDesktopPath() { L100: const currentPath = process.env.PATH || '';

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

electron/localServer.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = electron/localServer.js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

electron/localServer.jsView on unpkg

scripts/generate-pwa-icons.ps1View file

•path = scripts/generate-pwa-icons.ps1 kind = build_helper sizeBytes = 71 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/generate-pwa-icons.ps1View on unpkg

dist/windcli-browser-bridge.zipView file

•path = dist/windcli-browser-bridge.zip kind = high_entropy_blob sizeBytes = 74560 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/windcli-browser-bridge.zipView on unpkg

•path = dist/windcli-browser-bridge.zip kind = compressed_blob sizeBytes = 74560 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/windcli-browser-bridge.zipView on unpkg

•path = dist/windcli-browser-bridge.zip kind = nested_archive_needs_inspection sizeBytes = 74560 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/windcli-browser-bridge.zipView on unpkg

dist-server/scripts/fix-codex-sdk-windows-hide.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 18

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist-server/scripts/fix-codex-sdk-windows-hide.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = dist-server/scripts/fix-codex-sdk-windows-hide.js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-server/scripts/fix-codex-sdk-windows-hide.jsView on unpkg

dist-server/server/modules/cli/cli.module.jsView file

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = dist-server/server/modules/cli/cli.module.js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-server/server/modules/cli/cli.module.jsView on unpkg

scripts/fix-codex-sdk-windows-hide.jsView file

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = scripts/fix-codex-sdk-windows-hide.js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/fix-codex-sdk-windows-hide.jsView on unpkg

dist-server/server/modules/database/connection.jsView file

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = dist-[redacted].js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-server/server/modules/database/connection.jsView on unpkg

dist-server/server/modules/database/tests/provider-models.db.integration.test.jsView file

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = dist-[redacted]-models.db.integration.test.js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-server/server/modules/database/tests/provider-models.db.integration.test.jsView on unpkg

dist-server/server/modules/plugins/plugin-process.service.jsView file

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = dist-[redacted]-process.service.js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-server/server/modules/plugins/plugin-process.service.jsView on unpkg

dist-server/server/modules/plugins/plugin-registry.service.jsView file

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = dist-[redacted]-registry.service.js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-server/server/modules/plugins/plugin-registry.service.jsView on unpkg

dist-server/server/modules/providers/list/claude/claude-auth.provider.jsView file

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = dist-[redacted]-auth.provider.js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-server/server/modules/providers/list/claude/claude-auth.provider.jsView on unpkg

dist-server/server/modules/providers/list/opencode/opencode-auth.provider.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-server/server/modules/providers/list/opencode/opencode-auth.provider.jsView on unpkg

dist-server/server/modules/cli/sandbox.service.jsView file

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = dist-[redacted].service.js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-server/server/modules/cli/sandbox.service.jsView on unpkg

dist-server/server/modules/projects/services/project-clone.service.jsView file

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = dist-[redacted]-clone.service.js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-server/server/modules/projects/services/project-clone.service.jsView on unpkg

Source & flagged code

39 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-node-pty.js && node scripts/fix-codex-sdk-windows-hide.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/fix-node-pty.js && node scripts/fix-codex-sdk-windows-hide.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/assets/index-C68Z1NRo.jsView file

2patternName = github_pat severity = critical line = 2

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/assets/index-C68Z1NRo.jsView on unpkg · L2

Findings

7 Critical20 High13 Medium10 Low

CriticalCritical Secretdist/assets/index-C68Z1NRo.js

CriticalSecret Patterndist/assets/index-C68Z1NRo.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist-server/server/shared/claude-cli-path.js

HighShell

HighEntrypoint Build Divergencedist-server/server/index.js

HighSandbox Evasion Gated Capability

Affected versions and remediation

This report applies to wind-agent-cli@1.43.1.

See all versions of wind-agent-cli for other recorded verdicts.

Review the evidence and your use of wind-agent-cli@1.43.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 17:09:29.935Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code