wind-agent-cli@1.46.5

A local-first web interface for AI coding agents

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Source inspection found platform-specific compatibility scripts and user-triggered product operations, with no confirmed malicious chain or unrelated credential transfer. Scanner similarity and structural hints did not establish harmful behavior in the cited files.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Package installation runs the compatibility scripts; other reviewed behavior is triggered by user requests such as plugin installation, federation binding, or chat subscription.

Impact

No malicious impact was established from the inspected behavior.

Mechanism

The install scripts apply bounded platform fixes, while runtime routes process supplied project, login, plugin, or federation inputs.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The install hooks run a macOS permission fix and a Windows PM2 compatibility patch; the patch is platform-gated and checks for supported PM2 source layouts before modifying them.
Plugin installation is exposed through an explicit route, validates the supplied URL, and installs dependencies with scripts disabled.
Federation enrollment requires a locally configured standalone node and sends the supplied binding key to the selected master address, which must use HTTPS except for loopback testing; credential rotation targets an already connected node.
The inspected Git, authentication, and task-management hints are route-driven product operations using supplied project or login inputs; they do not establish unrelated credential forwarding or automatic account changes.
The WebSocket account-action hints resolve to an explicit chat subscription request and its handler; no automatic account action was identified.
The required high-similarity paths resolve to product assets and application modules; the inspected extension manifest describes a user-installed browser integration, and no attack behavior was identified.

Evidence against

Source & flagged code

39 flagged

package.jsonView file

Lines 53-93json

53 "build:client": "node scripts/package-browser-extension.mjs && node scripts/build-client.mjs && node scripts/verify-pwa-build.mjs",

54 "perf:client": "node scripts/measure-performance-baselines.mjs",

55 "perf:history": "tsx --tsconfig server/tsconfig.json scripts/measure-history-baselines.ts",

56 "perf:federation": "node scripts/measure-federation-overhead.mjs",

57 "prebuild:server": "node -e \"require('node:fs').rmSync('dist-server.next', { recursive: true, force: true })\"",

58 "build:server": "tsc -p server/tsconfig.json && tsc-alias -p server/tsconfig.json",

59 "build:server:defer": "cross-env WINDCLI_DEFER_SERVER_PROMOTION=1 npm run build:server",

60 "postbuild:server": "node scripts/promote-dist-server.mjs",

61 "preview": "vite preview",

62 "typecheck": "tsc --noEmit -p tsconfig.json && tsc --noEmit -p server/tsconfig.json",

63 "test": "tsx --tsconfig server/tsconfig.json --test --test-concurrency=1 \"server/**/*.test.ts\" \"server/**/*.test.js\"",

64 "test:client": "tsx --test \"src/**/*.test.ts\" \"src/**/*.test.tsx\" && npm run test:browser-extension && npm run test:browser-i18n",

65 "test:browser-extension": "node --test scripts/tests/browser-extension-*.test.mjs",

66 "test:browser-i18n": "node --test scripts/tests/browser-i18n-runtime.test.mjs",

67 "test:desktop-updater": "node --test scripts/tests/desktop-updater.test.mjs scripts/tests/desktop-package.test.mjs",

68 "lint": "eslint src/ server/ --max-warnings=0",

69 "lint:fix": "eslint src/ server/ --fix",

70 "start": "npm run build && npm run server",

71 "release": "./release.sh",

72 "prepublishOnly": "npm run build",

73 "postinstall": "node scripts/fix-node-pty.js && node scripts/fix-pm2-windows-console.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L73

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L73

74 "prepare": "husky",

75 "update:platform": "./update-platform.sh",

76 "audit:production": "npm audit --omit=dev --audit-level=low",

77 "audit:all": "npm audit --audit-level=low"

78 },

79 "build": {

80 "appId": "ai.cloudcli.desktop",

81 "productName": "WindCli",

82 "asar": false,

83 "artifactName": "windcli-desktop-${version}-${os}-${arch}.${ext}",

84 "directories": {

85 "output": "release/desktop"

86 },

87 "extraMetadata": {

88 "main": "electron/main.js"

89 },

90 "publish": {

91 "provider": "github",

92 "owner": "CaineWind",

93 "repo": "wacli"

dist/assets/common-DNF7JDgr.jsView file

Lines 1-2javascript

1const e={save:"儲存",cancel:"取消",delete:"刪除",create:"建立",edit:"編輯",close:"關閉",confirm:"確認",submit:"送出",retry:"重試",refresh:"重新整理",search:"搜尋",clear:"清除"

dist-server/server/shared/claude-cli-path.jsView file

Lines 1-21javascript

1import { execFileSync } from 'node:child_process';

2import fs from 'node:fs';

High

Child Process

Package source references child process execution.

dist-server/server/shared/claude-cli-path.jsView on unpkg · L1

3import path from 'node:path';

dist/assets/vendor-data-DPft5PCw.jsView file

Lines 1-5javascript

1import{e as we,g as jr}from"./vendor-react-C0GMoFE4.js";function ar(j,K){(K==null||K>j.length)&&(K

dist-server/server/modules/auth/auth.module.jsView file

Lines 1-27javascript

1import { createRequire } from 'node:module';

2import { getConnection, userDb } from '../../modules/database/index.js';

3import { authenticateToken, generateToken } from './auth.middleware.js';

4import { createAuthAttemptLimiter, createAuthRouter } from

dist-server/server/modules/auth/tests/server-error-mapping.test.jsView file

Lines 32-72javascript

32function createParserFixture() {

33 const app = express();

34 const logs = [];

35 const

dist-server/server/modules/providers/list/cursor/cursor-sessions.provider.jsView file

Lines 86-126javascript

86 }

87 }

88 return '';

89 })

90 .filter(Boolean)

91 .join('\n');

dist-server/server/index.jsView file

6Manifest entrypoint (manifest.main) carries capability families absent from dist/build output: environment+network L6: import os from 'os'; L7: import http from 'http'; L8: import express from 'express'; ... L36: import { configureWebPush } from './modules/notifications/index.js'; L37: const __dirname = getModuleDirectory(import.meta.url); L38: // The server source runs from /server, while the compiled output runs from /dist-server/server. ... L42: // Version of the code that is actually running, captured once at process L43: // startup. This intentionally does NOT re-read package.json per request: after L44: // an update replaces the files on disk, package.json reflects the NEW version ... L49: try { L50: return JSON.parse(fs.readFileSync(path.join(APP_ROOT, 'package.json'), 'utf8')).vers

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

dist-server/server/index.jsView on unpkg · L6

electron/main.jsView file

1import { app, BrowserWindow, clipboard, dialog, ipcMain, session, shell, webContents } from 'electron'; L2: import { spawn } from 'node:child_process'; L3: import path from 'node:path'; ... L12: L13: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L14: ... L18: const CALLBACK_URL = `${CALLBACK_PROTOCOL}://auth/callback`; L19: const CLOUDCLI_CONTROL_PLANE_URL = process.env.CLOUDCLI_CONTROL_PLANE_URL || 'https://cloudcli.ai'; L20: const REMOTE_START_TIMEOUT_MS = 30000; ... L24: L25: if (process.platform === 'win32') { L26: app.setAppUserModelId(APP_USER_MODEL_ID);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

electron/main.jsView on unpkg · L1

dist-server/server/modules/cli/cli.module.jsView file

1Detached bundled service listener: dist-server/server/modules/cli/cli.module.js spawns dist-server/server/index.js; helper exposes a broad-bound HTTP listener. L1: import { execFileSync } from 'node:child_process'; L2: import fs from 'node:fs'; ... L18: if (result.status !== 0) { L19: const stderr = typeof result.stderr === 'string' ? result.stderr.trim() : ''; L20: throw new Error(stderr || `npm exited with status ${result.status ?? 'unknown'}`); ... L30: stdio: 'inherit', L31: env: { ...process.env, WINDCLI_DEFER_SERVER_PROMOTION: '1' }, L32: }); ... L41: const applicationRoot = findApplicationRoot(getModuleDirectory(import.meta.url)); L42: const packageMetadataJson = JSON.parse(fs.readFileSync(path.join(applicationRoot, 'package.json'), 'utf8')); L43: const packageMetadata = { ... L58:

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist-server/server/modules/cli/cli.module.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = wind-agent-cli@1.46.8 matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.46.8 similarity = 0.817 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-server/server/modules/cli/cli.module.jsView on unpkg

scripts/windows-hidden-command-proxy.exeView file

•path = scripts/windows-hidden-command-proxy.exe kind = native_binary sizeBytes = 100352 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

scripts/windows-hidden-command-proxy.exeView on unpkg

scripts/generate-pwa-icons.ps1View file

•path = scripts/generate-pwa-icons.ps1 kind = build_helper sizeBytes = 71 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/generate-pwa-icons.ps1View on unpkg

dist/windcli-browser-bridge.zipView file

•path = dist/windcli-browser-bridge.zip kind = high_entropy_blob sizeBytes = 85566 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/windcli-browser-bridge.zipView on unpkg

•path = dist/windcli-browser-bridge.zip kind = compressed_blob sizeBytes = 85566 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/windcli-browser-bridge.zipView on unpkg

•path = dist/windcli-browser-bridge.zip kind = nested_archive_needs_inspection sizeBytes = 85566 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/windcli-browser-bridge.zipView on unpkg

dist-server/server/modules/assets/services/image-assets.service.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 20

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist-server/server/modules/assets/services/image-assets.service.jsView on unpkg

dist-server/server/modules/plugins/plugin-process.service.jsView file

•matchType = normalized_sha256 matchedPackage = wind-agent-cli@1.40.0 matchedPath = dist-[redacted]-process.service.js matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High