Loading npm security reports…
wind-agent-cli@1.46.1: Manual Review npm security report (Allow) | LPM Firewall
Allowed — no malicious behavior detected
No malicious behavior detected. 50 low-signal pattern(s) reviewed.
scanned 26d ago · by lpm-firewall-ai The postinstall scripts and plugin git installer that were read are narrow compatibility and user-invoked product behavior, not a concrete attack. A clean decision is blocked because this report requires 18 citations and only 8 can be stored, so the review stays unresolved.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
No confirmed attack trigger. npm postinstall and a later explicit plugin-install call were the behaviors inspected.
Impact
No confirmed malicious impact. Remaining uncertainty is incomplete citation coverage of other listed bundle files, not a demonstrated attack.
Mechanism
Postinstall adjusts a local node-pty binary mode on macOS and, on Windows, patches a matching PM2 pidusage file to call a bundled process-metrics helper. Plugin install clones a caller-supplied git URL only after string and path checks.
AI rationale
The postinstall scripts and plugin git installer that were read are narrow compatibility and user-invoked product behavior, not a concrete attack. A clean decision is blocked because this report requires 18 citations and only 8 can be stored, so the review stays unresolved.
public snapshot AI called this Manual Review at 62.0% confidence as Unknown with medium false-positive risk.
AI review observations
package.json postinstall only runs scripts/fix-node-pty.js and scripts/fix-pm2-windows-console.js. The node-pty postinstall helper returns unless the platform is darwin and then only chmods spawn-helper under node_modules/node-pty. The PM2 helper returns unless the platform is win32 and only rewrites a known pidusage invocation. installPluginFromGit is a runtime export that rejects a non-string URL; it is not an npm lifecycle hook. Clean publication would require 18 distinct source citations, but this review can store at most 8, so mark_clean cannot be finalized. Evidence against
No preinstall or install script and no dependency on the package name wind-agent-cli. scripts/windows-pidusage.c only prints creation time, CPU, parent PID, and working set for numeric process IDs. Plugin git clone is reached from the plugins module API, not from package.json lifecycle scripts. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Eval
40 flagged · loading source • scripts.postinstall = node scripts/fix-node-pty.js && node scripts/fix-pm2-windows-console.js
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg • scripts.postinstall = node scripts/fix-node-pty.js && node scripts/fix-pm2-windows-console.js
Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg dist/assets/feature-workspace-BIfrBuP9.js View file 39 patternName = github_pat
severity = critical
line = 39
Critical Critical Secret
Package contains a critical-looking secret pattern.
dist/assets/feature-workspace-BIfrBuP9.js View on unpkg · L39 9 Critical 17 High 14 Medium 10 Low
Critical Critical Secret dist/assets/feature-workspace-BIfrBuP9.js
Critical Secret Pattern dist/assets/feature-workspace-BIfrBuP9.js
Critical Secret Pattern dist/assets/index-fi3JKfnz.js
Critical Secret Pattern dist/assets/index-fi3JKfnz.js
Critical Secret Pattern dist/assets/index-fi3JKfnz.js
Critical Secret Pattern dist/assets/index-fi3JKfnz.js
Critical Secret Pattern dist/assets/index-fi3JKfnz.js
Critical Secret Pattern dist/assets/index-fi3JKfnz.js
Critical Secret Pattern dist/assets/index-fi3JKfnz.js
High Install Time Lifecycle Scripts package.json
High Entrypoint Build Divergence dist-server/server/index.js
Affected versions and remediation This report applies to wind-agent-cli@1.46.1 .
See all versions of wind-agent-cli for other recorded verdicts.
Review the evidence and your use of wind-agent-cli@1.46.1 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-09-27 14:40:34.179Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
62% Manual Review
AI assessment confidence
Package metadata npm Author WindCli contributors
Maintainers caine.luo
Version 1.46.1
Latest on npm 1.47.4
Published Sep 27, 2026
License AGPL-3.0-or-later
Dependencies 68
Integrity verified
Package size 11.0 MB
Files 1,230
Keywords claude code claude-code claude-code-ui cloudcli codex cursor cursor-cli anthropic
Filesystem
Network
Shell
WebSocket
Supply chain HighEntropyStrings Minified PossibleObfuscation Telemetry UrlStrings
scanned 772 file(s), 11.5 MB of source, external domains: 0.0.0.0, 10.0.0.7, 127.0.0.1, 169.254.169.254, 172.16.2.9, 192.168.1.9, another-project.test, api-gateway.cloudcli.ai, api.example.com, api.exemple.com, api.github.com, api.openai.com, app.example.test, attacker.example, bit.ly, browser-restarted.test, chevrotain.io, cloudcli.ai, cloudcli.example, codex.example.com, cursor.com, data-pipeline.cloudcli.ai, desktop.test, developer.mozilla.org, docs.anthropic.com, docs.docker.com, en.wikipedia.org, example.com, example.org, example.test, extension.test, fb.me, github.com, github.com.evil.example, global.example.com, langium.org, legacy.test, localhost.example.com, master.example, ml-trainer.cloudcli.ai, mobile.test, new-project.test, new.test, old.test, opencode.ai, opencode.example.com, other-window.test, other.example.test, other.test, private.test
39 patternName = github_pat
severity = critical
line = 39
Critical Secret Pattern
GitHub personal access token in dist/assets/feature-workspace-BIfrBuP9.js
dist/assets/feature-workspace-BIfrBuP9.js View on unpkg · L39 1 import{r as Y,j as X}from"./vendor-react-C2GTiUCy.js";import{H as Me}from"./typography-BN7vStia.js";import{ae as mt,ad as St,ai as at,j as $e}from"./feature-workspace-BIfrBuP9.js";...
L2: layout (location = 0) in vec2 a_unitquad;
Low Eval
Package source references a known benign dynamic code generation pattern.
dist/assets/Shell--z1Ul7hJ.js View on unpkg · L1 dist-server/server/modules/auth/auth.module.js View file 7 // composition root narrows its CommonJS runtime surface before injecting it.
L8: const require = createRequire(import.meta.url);
L9: const bcrypt = require('bcrypt');
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist-server/server/modules/auth/auth.module.js View on unpkg · L7 scripts/tests/browser-extension-connection.test.mjs View file 54 return new Response(JSON.stringify(connectError ? { error: connectError } : {
L55: success: true, data: { protocolVersion: 3, sessionId: 'bound-chrome', token: 'fixture-credential', scope: 'browser', name: 'Work Chrome', controller: 'agent' },
L56: }), { status: connectError ? 400 : 200 });
...
L69: async function openPopup() {
L70: const dom = new JSDOM(html, { url: 'https://extension.test/popup.html' });
L71: let disposed = false;
Medium Unsafe Vm Context
Package source executes code through a VM context API.
scripts/tests/browser-extension-connection.test.mjs View on unpkg · L54 dist-server/server/modules/providers/list/cursor/cursor-sessions.provider.js View file 106 try {
L107: return JSON.parse(trimmed);
L108: }
...
L172: const { default: Database } = await import('better-sqlite3');
L173: const cwdId = crypto.createHash('md5').update(projectPath || process.cwd()).digest('hex');
L174: const safeSessionId = sanitizeLeafDirectoryName(sessionId, 'cursor session id');
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist-server/server/modules/providers/list/cursor/cursor-sessions.provider.js View on unpkg · L106 6 Manifest entrypoint (manifest.main) carries capability families absent from dist/build output: environment+network
L6: import os from 'os';
L7: import http from 'http';
L8: import express from 'express';
...
L36: import { configureWebPush } from './modules/notifications/index.js';
L37: const __dirname = getModuleDirectory(import.meta.url);
L38: // The server source runs from /server, while the compiled output runs from /dist-server/server.
...
L42: // Version of the code that is actually running, captured once at process
L43: // startup. This intentionally does NOT re-read package.json per request: after
L44: // an update replaces the files on disk, package.json reflects the NEW version
...
L49: try {
L50: return JSON.parse(fs.readFileSync(path.join(APP_ROOT, 'package.json'), 'utf8')).vers
High Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
dist-server/server/index.js View on unpkg · L6 1 import { app, BrowserWindow, clipboard, dialog, ipcMain, session, shell, webContents } from 'electron';
L2: import { spawn } from 'node:child_process';
L3: import path from 'node:path';
...
L12:
L13: const __dirname = path.dirname(fileURLToPath(import.meta.url));
L14:
...
L18: const CALLBACK_URL = `${CALLBACK_PROTOCOL}://auth/callback`;
L19: const CLOUDCLI_CONTROL_PLANE_URL = process.env.CLOUDCLI_CONTROL_PLANE_URL || 'https://cloudcli.ai';
L20: const REMOTE_START_TIMEOUT_MS = 30000;
...
L24:
L25: if (process.platform === 'win32') {
L26: app.setAppUserModelId(APP_USER_MODEL_ID);
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
electron/main.js View on unpkg · L1 scripts/windows-hidden-command-proxy.exe View file • path = scripts/windows-hidden-command-proxy.exe
kind = native_binary
sizeBytes = 100352
magicHex = [redacted]
Medium Ships Native Binary
Package ships native binary artifacts.
scripts/windows-hidden-command-proxy.exe View on unpkg • path = scripts/generate-pwa-icons.ps1
kind = build_helper
sizeBytes = 73
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
scripts/generate-pwa-icons.ps1 View on unpkg • path = dist/windcli-browser-bridge.zip
kind = high_entropy_blob
sizeBytes = 85735
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dist/windcli-browser-bridge.zip View on unpkg • path = dist/windcli-browser-bridge.zip
kind = compressed_blob
sizeBytes = 85735
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
dist/windcli-browser-bridge.zip View on unpkg • path = dist/windcli-browser-bridge.zip
kind = nested_archive_needs_inspection
sizeBytes = 85735
magicHex = [redacted]
Low Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
dist/windcli-browser-bridge.zip View on unpkg dist-server/server/modules/assets/services/image-assets.service.js View file • stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 19
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist-server/server/modules/assets/services/image-assets.service.js View on unpkg dist-server/server/modules/database/connection.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted].js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/database/connection.js View on unpkg dist-server/server/modules/database/tests/provider-models.db.integration.test.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted]-models.db.integration.test.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/database/tests/provider-models.db.integration.test.js View on unpkg dist-server/server/modules/plugins/plugin-process.service.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted]-process.service.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/plugins/plugin-process.service.js View on unpkg dist-server/server/modules/plugins/plugin-registry.service.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted]-registry.service.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/plugins/plugin-registry.service.js View on unpkg dist-server/server/modules/cli/sandbox.service.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted].service.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/cli/sandbox.service.js View on unpkg dist-server/server/modules/projects/services/project-clone.service.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted]-clone.service.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/projects/services/project-clone.service.js View on unpkg dist-server/server/modules/providers/tests/opencode-sessions.test.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted]-sessions.test.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/providers/tests/opencode-sessions.test.js View on unpkg dist/assets/diagram-Q27KOJAE-DkK4M9P3.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist/assets/diagram-Q27KOJAE-D_1NRrhv.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/assets/diagram-Q27KOJAE-DkK4M9P3.js View on unpkg dist/assets/flowDiagram-UKHOOZJN-CIDZNJ77.js View file • matchType = token_shingles
matchedPackage = @dotobokuri/fleet-console@1.90.0
matchedPath = dist/client/assets/flowDiagram-DWJPFMVM-Dz5wLJVG.js
matchedIdentity = npm:[redacted]:1.90.0
similarity = 1.000
shingleOverlap = 48
summary = source token shingles overlapped finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/assets/flowDiagram-UKHOOZJN-CIDZNJ77.js View on unpkg dist/assets/wardleyDiagram-T6FBY63Y-Bhe3p2Z8.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist/assets/wardleyDiagram-T6FBY63Y-CRgRdD3Z.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/assets/wardleyDiagram-T6FBY63Y-Bhe3p2Z8.js View on unpkg • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist/workbox-ae5c0bb2.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/workbox-ae5c0bb2.js View on unpkg dist-server/server/modules/browser-use/browser-use.service.js View file • matchType = previous_version_dangerous_delta
matchedPackage = wind-agent-cli@1.44.11
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.44.11
similarity = 0.692
summary = stored previous version shares package body but lacks this dangerous source file
High Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist-server/server/modules/browser-use/browser-use.service.js View on unpkg 2 patternName = github_pat
severity = critical
line = 2
Critical Secret Pattern
GitHub personal access token in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L2 5 patternName = github_pat
severity = critical
line = 5
Critical Secret Pattern
GitHub personal access token in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L5 8 patternName = github_pat
severity = critical
line = 8
Critical Secret Pattern
GitHub personal access token in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L8 11 patternName = github_pat
severity = critical
line = 11
Critical Secret Pattern
GitHub personal access token in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L11 14 patternName = github_pat
severity = critical
line = 14
Critical Secret Pattern
GitHub personal access token in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L14 17 patternName = github_pat
severity = critical
line = 17
Critical Secret Pattern
GitHub personal access token in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L17 20 patternName = github_pat
severity = critical
line = 20
Critical Secret Pattern
GitHub personal access token in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L20 2 patternName = generic_password
severity = medium
line = 2
Medium Secret Pattern
Hardcoded password in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L2 5 patternName = generic_password
severity = medium
line = 5
Medium Secret Pattern
Hardcoded password in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L5 8 patternName = generic_password
severity = medium
line = 8
Medium Secret Pattern
Hardcoded password in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L8 11 patternName = generic_password
severity = medium
line = 11
Medium Secret Pattern
Hardcoded password in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L11 17 patternName = generic_password
severity = medium
line = 17
Medium Secret Pattern
Hardcoded password in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L17 High Sandbox Evasion Gated Capability electron/main.js
High Ships High Entropy Blob dist/windcli-browser-bridge.zip
High Semantic Analysis Limited dist-server/server/modules/assets/services/image-assets.service.js
High Known Malware Source Similarity dist-server/server/modules/database/connection.js
High Known Malware Source Similarity dist-server/server/modules/database/tests/provider-models.db.integration.test.js
High Known Malware Source Similarity dist-server/server/modules/plugins/plugin-process.service.js
High Known Malware Source Similarity dist-server/server/modules/plugins/plugin-registry.service.js
High Known Malware Source Similarity dist-server/server/modules/cli/sandbox.service.js
High Known Malware Source Similarity dist-server/server/modules/projects/services/project-clone.service.js
High Known Malware Source Similarity dist-server/server/modules/providers/tests/opencode-sessions.test.js
High Known Malware Source Similarity dist/assets/diagram-Q27KOJAE-DkK4M9P3.js
High Known Malware Source Similarity dist/assets/flowDiagram-UKHOOZJN-CIDZNJ77.js
High Known Malware Source Similarity dist/assets/wardleyDiagram-T6FBY63Y-Bhe3p2Z8.js
High Known Malware Source Similarity dist/workbox-ae5c0bb2.js
High Previous Version Dangerous Delta dist-server/server/modules/browser-use/browser-use.service.js
Medium Ambiguous Install Lifecycle Script package.json
Medium Dynamic Require dist-server/server/modules/auth/auth.module.js
Medium Unsafe Vm Context scripts/tests/browser-extension-connection.test.mjs
Medium Ships Native Binary scripts/windows-hidden-command-proxy.exe
Medium Ships Build Helper scripts/generate-pwa-icons.ps1
Medium Ships Compressed Blob dist/windcli-browser-bridge.zip
Medium Structural Risk Force Deep Review
Medium Secret Pattern dist/assets/index-fi3JKfnz.js
Medium Secret Pattern dist/assets/index-fi3JKfnz.js
Medium Secret Pattern dist/assets/index-fi3JKfnz.js
Medium Secret Pattern dist/assets/index-fi3JKfnz.js
Medium Secret Pattern dist/assets/index-fi3JKfnz.js
Low Non Install Lifecycle Scripts
Low Eval dist/assets/Shell--z1Ul7hJ.js
Low Weak Crypto dist-server/server/modules/providers/list/cursor/cursor-sessions.provider.js
Low Nested Archive Needs Inspection dist/windcli-browser-bridge.zip
Runtime surface package.json Entrypoints main → dist-server/server/index.js bin → wacli
Runtime node >=22
Artifact 24.5 MB · 1,230 files 2 signature(s)
Install lifecycle postinstall prepare prepublishOnly
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem Network Shell WebSocket HighEntropyStrings Minified PossibleObfuscation Telemetry UrlStrings CopyleftLicense
40 flagged Lines 48-88 json
48 "desktop:dist:win" : "npm run build && npm run desktop:stage && electron-builder --projectDir .desktop-build/desktop-app --win nsis" ,
49 "server:bundle" : "npm run build && node scripts/release/build-server-bundle.js" ,
50 "desktop:icon:mac" : "node electron/scripts/generate-macos-icon.js" ,
51 "assets:brand" : "node scripts/generate-brand-assets.mjs" ,
52 "build" : "npm run build:client && npm run build:server" ,
53 "build:client" : "node scripts/package-browser-extension.mjs && node scripts/build-client.mjs && node scripts/verify-pwa-build.mjs" ,
54 "prebuild:server" : "node -e \" require('node:fs').rmSync('dist-server.next', { recursive: true, force: true }) \" " ,
55 "build:server" : "tsc -p server/tsconfig.json && tsc-alias -p server/tsconfig.json" ,
56 "postbuild:server" : "node scripts/promote-dist-server.mjs" ,
57 "preview" : "vite preview" ,
58 "typecheck" : "tsc --noEmit -p tsconfig.json && tsc --noEmit -p server/tsconfig.json" ,
59 "test" : "tsx --tsconfig server/tsconfig.json --test --test-concurrency=1 \" server/**/*.test.ts \" \" server/**/*.test.js \" " ,
60 "test:client" : "tsx --test \" src/**/*.test.ts \" \" src/**/*.test.tsx \" && npm run test:browser-extension" ,
61 "test:browser-extension" : "node --test scripts/tests/browser-extension-*.test.mjs" ,
62 "test:desktop-updater" : "node --test scripts/tests/desktop-updater.test.mjs scripts/tests/desktop-package.test.mjs" ,
63 "lint" : "eslint src/ server/ --max-warnings=0" ,
64 "lint:fix" : "eslint src/ server/ --fix" ,
65 "start" : "npm run build && npm run server" ,
66 "release" : "./release.sh" ,
67 "prepublishOnly" : "npm run build" ,
68 "postinstall" : "node scripts/fix-node-pty.js && node scripts/fix-pm2-windows-console.js" ,
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg · L68 Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg · L68 70 "update:platform" : "./update-platform.sh" ,
71 "audit:production" : "npm audit --omit=dev --audit-level=low" ,
72 "audit:all" : "npm audit --audit-level=low"
75 "appId" : "ai.cloudcli.desktop" ,
76 "productName" : "WindCli" ,
78 "artifactName" : "windcli-desktop-${version}-${os}-${arch}.${ext}" ,
80 "output" : "release/desktop"
83 "main" : "electron/main.js"
dist/assets/feature-workspace-BIfrBuP9.js View file Lines 19-59 javascript
19 after :rounded - full after :bg - white after :shadow - sm after :transition - transform after :duration - 200
1 import{r as Y,j as X}from"./vendor-react-C2GTiUCy.js";import{H as Me}from"./typography-BN7vStia.js";import{ae as mt,ad as St,ai as at,j as $e}from"./feature-workspace-BIfrBuP9.js";...
L2: layout (location = 0) in vec2 a_unitquad;
Low Eval
Package source references a known benign dynamic code generation pattern.
dist/assets/Shell--z1Ul7hJ.js View on unpkg · L1 dist-server/server/modules/auth/auth.module.js View file 7 // composition root narrows its CommonJS runtime surface before injecting it.
L8: const require = createRequire(import.meta.url);
L9: const bcrypt = require('bcrypt');
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist-server/server/modules/auth/auth.module.js View on unpkg · L7 scripts/tests/browser-extension-connection.test.mjs View file Lines 34-74 javascript
35 id : 'windcli-test' , getManifest : () => ({ version: '2.0.0' }),
36 onMessage : { addListener : ( listener ) => { onMessage =
dist-server/server/modules/providers/list/cursor/cursor-sessions.provider.js View file 6 Manifest entrypoint (manifest.main) carries capability families absent from dist/build output: environment+network
L6: import os from 'os';
L7: import http from 'http';
L8: import express from 'express';
...
L36: import { configureWebPush } from './modules/notifications/index.js';
L37: const __dirname = getModuleDirectory(import.meta.url);
L38: // The server source runs from /server, while the compiled output runs from /dist-server/server.
...
L42: // Version of the code that is actually running, captured once at process
L43: // startup. This intentionally does NOT re-read package.json per request: after
L44: // an update replaces the files on disk, package.json reflects the NEW version
...
L49: try {
L50: return JSON.parse(fs.readFileSync(path.join(APP_ROOT, 'package.json'), 'utf8')).vers
High Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
dist-server/server/index.js View on unpkg · L6 1 import { app, BrowserWindow, clipboard, dialog, ipcMain, session, shell, webContents } from 'electron';
L2: import { spawn } from 'node:child_process';
L3: import path from 'node:path';
...
L12:
L13: const __dirname = path.dirname(fileURLToPath(import.meta.url));
L14:
...
L18: const CALLBACK_URL = `${CALLBACK_PROTOCOL}://auth/callback`;
L19: const CLOUDCLI_CONTROL_PLANE_URL = process.env.CLOUDCLI_CONTROL_PLANE_URL || 'https://cloudcli.ai';
L20: const REMOTE_START_TIMEOUT_MS = 30000;
...
L24:
L25: if (process.platform === 'win32') {
L26: app.setAppUserModelId(APP_USER_MODEL_ID);
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
electron/main.js View on unpkg · L1 scripts/windows-hidden-command-proxy.exe View file • path = scripts/windows-hidden-command-proxy.exe
kind = native_binary
sizeBytes = 100352
magicHex = [redacted]
Medium Ships Native Binary
Package ships native binary artifacts.
scripts/windows-hidden-command-proxy.exe View on unpkg • path = scripts/generate-pwa-icons.ps1
kind = build_helper
sizeBytes = 73
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
scripts/generate-pwa-icons.ps1 View on unpkg • path = dist/windcli-browser-bridge.zip
kind = high_entropy_blob
sizeBytes = 85735
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dist/windcli-browser-bridge.zip View on unpkg • path = dist/windcli-browser-bridge.zip
kind = compressed_blob
sizeBytes = 85735
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
dist/windcli-browser-bridge.zip View on unpkg • path = dist/windcli-browser-bridge.zip
kind = nested_archive_needs_inspection
sizeBytes = 85735
magicHex = [redacted]
Low Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
dist/windcli-browser-bridge.zip View on unpkg dist-server/server/modules/assets/services/image-assets.service.js View file • stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 19
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist-server/server/modules/assets/services/image-assets.service.js View on unpkg dist-server/server/modules/database/connection.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted].js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/database/connection.js View on unpkg dist-server/server/modules/database/tests/provider-models.db.integration.test.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted]-models.db.integration.test.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/database/tests/provider-models.db.integration.test.js View on unpkg dist-server/server/modules/plugins/plugin-process.service.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted]-process.service.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/plugins/plugin-process.service.js View on unpkg dist-server/server/modules/plugins/plugin-registry.service.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted]-registry.service.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/plugins/plugin-registry.service.js View on unpkg dist-server/server/modules/cli/sandbox.service.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted].service.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/cli/sandbox.service.js View on unpkg dist-server/server/modules/projects/services/project-clone.service.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted]-clone.service.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/projects/services/project-clone.service.js View on unpkg dist-server/server/modules/providers/tests/opencode-sessions.test.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted]-sessions.test.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/providers/tests/opencode-sessions.test.js View on unpkg dist/assets/diagram-Q27KOJAE-DkK4M9P3.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist/assets/diagram-Q27KOJAE-D_1NRrhv.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/assets/diagram-Q27KOJAE-DkK4M9P3.js View on unpkg dist/assets/flowDiagram-UKHOOZJN-CIDZNJ77.js View file • matchType = token_shingles
matchedPackage = @dotobokuri/fleet-console@1.90.0
matchedPath = dist/client/assets/flowDiagram-DWJPFMVM-Dz5wLJVG.js
matchedIdentity = npm:[redacted]:1.90.0
similarity = 1.000
shingleOverlap = 48
summary = source token shingles overlapped finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/assets/flowDiagram-UKHOOZJN-CIDZNJ77.js View on unpkg dist/assets/wardleyDiagram-T6FBY63Y-Bhe3p2Z8.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist/assets/wardleyDiagram-T6FBY63Y-CRgRdD3Z.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/assets/wardleyDiagram-T6FBY63Y-Bhe3p2Z8.js View on unpkg • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist/workbox-ae5c0bb2.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/workbox-ae5c0bb2.js View on unpkg dist-server/server/modules/browser-use/browser-use.service.js View file • matchType = previous_version_dangerous_delta
matchedPackage = wind-agent-cli@1.44.11
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.44.11
similarity = 0.692
summary = stored previous version shares package body but lacks this dangerous source file
High Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist-server/server/modules/browser-use/browser-use.service.js View on unpkg 2 patternName = github_pat
severity = critical
line = 2
Critical Secret Pattern
GitHub personal access token in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L2 5 patternName = github_pat
severity = critical
line = 5
Critical Secret Pattern
GitHub personal access token in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L5 8 patternName = github_pat
severity = critical
line = 8
Critical Secret Pattern
GitHub personal access token in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L8 11 patternName = github_pat
severity = critical
line = 11
Critical Secret Pattern
GitHub personal access token in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L11 ''
] peer
-
checked
:bg
-
emerald
-
500
21 peer - checked : after :translate - x - 4
22 `})]})}function um({running:t,t:s}){return t?e.jsxs("span",{className:"relative flex items-center gap-1.5",children:[e.jsxs("span",{className:"relative flex h-1.5 w-1.5",children:[e.jsx("span",{className:"absolute inline-flex h-full w-full animate-ping rounded-full bg-emerald-400 opacity-75"}),e.jsx("span",{className:"relative inline-flex h-1.5 w-1.5 rounded-full bg-emerald-500"})]}),e.jsx("span",{className:"font-mono text-[10px] uppercase tracking-wide text-emerald-600 dark:text-emerald-400",children:s("pluginSettings.runningStatus")})]}):null}function mm({plugin:t,index:s,onToggle:r, ...
23 ` ), y (be ? Pm : null ), w ( "" ); try { const A =await $ ( "/api/system/update" ,{method: "POST" }), M =await A . text (); let W = null ; try { W = JSON . parse ( M )} catch { W = null } if ( ! W ){ if (be) S ( K => K + `
24 Update started. The server appears to be restarting to apply it.
25 ` ); else { y ( null ); const K = `The update endpoint returned an unexpected response (HTTP ${ A . status }). Update manually with the command below.` ; w ( K ), S ( H => H + `
27 ` )} return } if ( A .ok){ if ( S ( K => K + ( W .output || "" ) + `
29 ✅ Update completed successfully!
30 ` ), ! be){ const K = W .targetVersion || o; S ( H => H + `${ p ( "versionUpdate.status.restarting" ) }
31 ` ), K &&await E ( K )}} else y ( null ), w ( W .error || "Update failed" ), S ( K => K + `
32 ❌ Update failed: ` + ( W .error || "Unknown error" ) + `
33 ` )} catch ( A ){be ? S ( M => M + `
34 Connection to the server was interrupted — it is likely restarting to apply the update.
35 ` ) : ( y ( null ), w ( A .message), S ( M => M + `
36 ❌ Update failed: ` + A .message + `
37 ` ))} finally { b ( ! 1 )}},[k,o,f,m,p,l, E ]),z = a. useCallback (() => { j ( ! 0 )},[]), B = a. useCallback (() => { j ( ! 1 ), R ()},[ R ]); return t ? e. jsxs ( "div" ,{className: "fixed inset-0 z-50 flex items-center justify-center" ,children:[e. jsx ( "button" ,{className: "fixed inset-0 bg-black/50 backdrop-blur-sm" ,onClick:g ?void 0 : s,disabled:g, "aria-label" : p ( "versionUpdate.ariaLabels.closeModal" )}),e. jsxs ( "div" ,{className: "relative mx-4 max-h-[90vh] w-full max-w-2xl space-y-4 overflow-y-auto rounded-lg border border-gray-200 bg-white p-6 shadow-xl dark:border-gray-700 dark:bg-gray-800" ,children:[e. jsxs ( "div" ,{className: "flex items-cen .. .
39 `).trim():"";function Rm({message:t}){return e.jsxs("div",{className:"flex items-start gap-3 rounded-lg border border-red-200 bg-red-50 p-4 dark:border-red-800 dark:bg-red-900/20",children:[e.jsx(na,{className:"mt-0.5 h-5 w-5 flex-shrink-0 text-red-600 dark:text-red-400"}),e.jsx("p",{className:"text-sm text-red-800 dark:text-red-200",children:t})]})}const Lm=["git@","ssh://"],Am=/^[A-Za-z]: \\ ?$/,Po=t=>{const s=t.trim();return Lm.some(r=>s.startsWith(r))},Eo=t=>t.trim().length>0&&!Po(t),sa=t=>t.trim().length>0,Mm=t=>{const s=t.trim(),r=Math.max(s.lastIndexOf("/"),s.lastIndexOf(" \\ "));return r== ...
Critical Critical Secret
Package contains a critical-looking secret pattern.
dist/assets/feature-workspace-BIfrBuP9.js View on unpkg · L39 40 let context=${ JSON . stringify ( d ). replace ( /</ g , " \\ u003c" ) };const pending=new Map(),listeners=new Set(),sockets=new Map();let sequence=0;
41 const send=(value)=>parent.postMessage(value,'*');
42 addEventListener('message',(event)=>{if(event.source!==parent)return;const m=event.data;
43 if(m.type==='plugin-context'){context=m.context;listeners.forEach(fn=>fn(context));}
44 if(m.type==='plugin-result'){const p=pending.get(m.id);if(p){pending.delete(m.id);clearTimeout(p.timer);m.error?p.reject(Error(m.error)):p.resolve(m.result);}}
45 const ws=sockets.get(m.id);if(ws){if(m.type==='plugin-ws-opened'){ws.readyState=1;ws.dispatchEvent(new Event('open'));}
46 if(m.type==='plugin-ws-message')ws.dispatchEvent(new MessageEvent('message',{data:m.data}));
47 if(m.type==='plugin-ws-close'){ws.readyState=3;ws.dispatchEvent(new Event('close'));sockets.delete(m.id);}}});
48 class Socket extends EventTarget{static CONNECTING=0;static OPEN=1;static CLOSING=2;static CLOSED=3;readyState=0;
49 constructor(url){super();this.id=String(++sequence);sockets.set(this.id,this);send({type:'plugin-ws-open',id:this.id,url:String(url)});['open','message','close','error'].forEach(name=>this.addEventListener(name,event=>this['on'+name]?.(event)));}
50 send(data){if(this.readyState!==1)throw Error('Socket not open');send({type:'plugin-ws-send',id:this.id,data});}
51 close(){this.readyState=2;send({type:'plugin-ws-close',id:this.id});}}
52 window.WebSocket=Socket;
53 const api={get context(){return context;},onContextChange(fn){listeners.add(fn);return()=>listeners.delete(fn);},rpc(method,path,body){
54 return new Promise((resolve,reject)=>{if(pending.size>=32)return reject(Error('Too many requests'));const id=String(++sequence);
55 const timer=setTimeout(()=>{pending.delete(id);reject(Error('RPC timed out'));},30000);pending.set(id,{resolve,reject,timer});send({type:'plugin-rpc',id,method,path,body});});}};
56 const blob=new Blob([${ g }],{type:'application/javascript'});const url=URL.createObjectURL(blob);
57 import(url).then(mod=>mod.mount?.(document.getElementById('plugin'),api)).then(()=>send({type:'plugin-ready'})).catch(error=>send({type:'plugin-error',error:String(error)})).finally(()=>URL.revokeObjectURL(url));
58 < \/ script></body></html>` ;return e. jsx ( "iframe" ,{ref:c,title:t,className: "h-full w-full border-0" ,sandbox: "allow-scripts" ,srcDoc:h})} function ra ( t , s , r ){ return {theme:t ? "dark" : "light" ,project:s ? {name:s.projectId,path:s.fullPath || s.path || "" } : null ,session:r ? {id:r.id,title:r.title || r.name || r.id} : null }} function rp ( t ){ return Pt ? e. jsx (sp,{ ... t}) : e. jsx (np,{ ... t})} function np ({ pluginName : t , selectedProject : s , selectedSession : r }){ const n = a. useRef ( null ),{ isDarkMode : o } = Ls (),{ plugins : i } = zr (), c = a. useRef ( ra (o,s,r)), l = a. useRef ( new Set), x = a. useRef ( null ), u = i. find ( m => m.name === t); return a. useEffect (() => { const m = ra ...
Long lines were clipped for display.
39 patternName = github_pat
severity = critical
line = 39
Critical Secret Pattern
GitHub personal access token in dist/assets/feature-workspace-BIfrBuP9.js
dist/assets/feature-workspace-BIfrBuP9.js View on unpkg · L39 listener; } },
37 onStartup : { addListener () {} }, onInstalled : { addListener () {} },
39 storage : { local : storage (local), session : storage (session) },
41 contains : async () => granted,
42 onAdded : { addListener : ( listener ) => permissionEvents. push (listener) },
43 onRemoved : { addListener () {} },
45 alarms : { create : async () => undefined , onAlarm : { addListener () {} } },
46 action : { setBadgeText : async () => undefined , setIcon : async () => undefined },
47 debugger : { onDetach: { addListener () {} }, onEvent: { addListener () {} } },
48 tabs : { onCreated : { addListener () {} } },
50 const timers = { setTimeout : () => 1 , clearTimeout () {} };
51 const fetch = async ( url ) => {
53 if (url. endsWith ( '/connect' )) {
54 return new Response ( JSON . stringify (connectError ? { error: connectError } : {
55 success: true , data: { protocolVersion: 3 , sessionId: 'bound-chrome' , token: 'fixture-credential' , scope: 'browser' , name: 'Work Chrome' , controller: 'agent' },
56 }), { status: connectError ? 400 : 200 });
58 if (url. endsWith ( '/poll' )) return new Promise (() => {});
59 return new Response ( JSON . stringify ({ success: true , data: {} }));
61 // Page-action helpers are unused by pairing; retain all production connection code.
62 const workerSource = backgroundCode. replace ( / ^ import . * \r ? \n / gm , '' );
63 vm. runInNewContext (workerSource, { createMobileEmulation, chrome, fetch, URL, AbortSignal, console, ... timers }, { filename: 'background.js' });
65 const sendMessage = ( message ) => {
66 messages. push (message.action);
67 return new Promise (( resolve ) => onMessage (message, { id: chrome.runtime.id }, resolve));
69 async function openPopup () {
70 const dom = new JSDOM (html, { url: 'https://extension.test/popup.html' });
71 let disposed = false ;
Medium Unsafe Vm Context
Package source executes code through a VM context API.
scripts/tests/browser-extension-connection.test.mjs View on unpkg · L54 72 const close = dom.window.close. bind (dom.window);
73 dom.window. close = () => { disposed = true ; close (); };
74 const popupSendMessage = ( message ) => new Promise (( resolve , reject ) => {
92 if (experimentalText. trim ()) {
93 return experimentalText;
96 return typeof item.result === 'string' ? item.result : '' ;
98 function parseCursorToolInput ( rawInput ) {
99 if ( typeof rawInput !== 'string' ) {
102 const trimmed = rawInput. trim ();
107 return JSON . parse (trimmed);
108 }
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist-server/server/modules/providers/list/cursor/cursor-sessions.provider.js View on unpkg · L106 113 function normalizeCursorToolInput ( toolName , rawInput ) {
114 const parsed = parseCursorToolInput (rawInput);
115 if ( ! parsed || typeof parsed !== 'object' || Array. isArray (parsed)) {
118 const input = parsed;
119 const normalized = { ... input };
120 const filePath = input.file_path
125 if ( typeof filePath === 'string' && filePath. trim ()) {
126 normalized.file_path = filePath;
14 patternName = github_pat
severity = critical
line = 14
Critical Secret Pattern
GitHub personal access token in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L14 17 patternName = github_pat
severity = critical
line = 17
Critical Secret Pattern
GitHub personal access token in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L17 20 patternName = github_pat
severity = critical
line = 20
Critical Secret Pattern
GitHub personal access token in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L20 2 patternName = generic_password
severity = medium
line = 2
Medium Secret Pattern
Hardcoded password in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L2 5 patternName = generic_password
severity = medium
line = 5
Medium Secret Pattern
Hardcoded password in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L5 8 patternName = generic_password
severity = medium
line = 8
Medium Secret Pattern
Hardcoded password in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L8 11 patternName = generic_password
severity = medium
line = 11
Medium Secret Pattern
Hardcoded password in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L11 17 patternName = generic_password
severity = medium
line = 17
Medium Secret Pattern
Hardcoded password in dist/assets/index-fi3JKfnz.js
dist/assets/index-fi3JKfnz.js View on unpkg · L17