wind-agent-cli@1.47.4

⚠ Under review

A local-first web interface for AI coding agents

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The inspected postinstall behavior is consistent with local platform compatibility setup, and the federation excerpt shows a configured enrollment flow rather than proven credential exfiltration. The required runtime review remains incomplete, including a binary path that cannot support clean citation coverage, so the evidence does not support either a clean verdict or a confirmed attack.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

No malicious trigger was confirmed in the inspected excerpts.

Impact

No concrete harmful impact was established; unresolved source prevents a clean determination.

Mechanism

The inspected postinstall scripts perform platform compatibility setup, and the inspected federation path enrolls with a configured master using a supplied binding key.

AI rationale

Decision evidence

public snapshot

AI called this Manual Review at 62.0% confidence as Unknown with medium false-positive risk.

AI review observations

package.json defines a postinstall that runs two local compatibility scripts.
The macOS helper adjusts permissions on bundled node-pty spawn helpers; the Windows helper patches PM2 process metrics compatibility.
Plugin installation is implemented as a Git clone capability exposed through the plugin module.
Federation enrollment posts a node ID, name, and supplied binding key to the configured master; the inspected excerpt does not establish credential theft.
The required review set includes a binary browser bridge and many runtime files that remain unresolved.

Evidence against

Inspected install-time behavior is limited to platform compatibility setup.
No concrete attack behavior was established in the inspected excerpts.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

Source & flagged code

37 flagged

package.jsonView file

•scripts.postinstall = node scripts/fix-node-pty.js && node scripts/fix-pm2-windows-console.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/fix-node-pty.js && node scripts/fix-pm2-windows-console.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•Remote tarball dependency specs: windbrowser-mcp@https://github.[redacted]-v0.1.2/windbrowser-mcp-0.1.2.tgz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

release/dist/assets/common-DNF7JDgr.jsView file

1patternName = github_pat severity = critical line = 1

Critical

Critical Secret

Package contains a critical-looking secret pattern.

release/dist/assets/common-DNF7JDgr.jsView on unpkg · L1

1patternName = github_pat severity = critical line = 1

Critical

Secret Pattern

GitHub personal access token in release/dist/assets/common-DNF7JDgr.js

release/dist/assets/common-DNF7JDgr.jsView on unpkg · L1

release/dist-server/server/modules/cli/cli.module.jsView file

1var w=Object.defineProperty;var t=(o,n)=>w(o,"name",{value:n,configurable:!0});import{execFileSync as l}from"node:child_process";import p from"node:fs";import S from"node:os";impor...

High

Child Process

Package source references child process execution.

release/dist-server/server/modules/cli/cli.module.jsView on unpkg · L1

release/dist/assets/vendor-data-p1E8MiDo.jsView file

1var Wr=Object.defineProperty;var l=(j,$)=>Wr(j,"name",{value:$,configurable:!0});import{e as wt,g as jr}from"./vendor-react-FnodSsW-.js";function ir(j,$){($==null||$>j.length)&&($=...

Low

Eval

Package source references a known benign dynamic code generation pattern.

release/dist/assets/vendor-data-p1E8MiDo.jsView on unpkg · L1

release/dist-server/server/modules/browser-use/browser-use.service.jsView file

1var Oe=Object.defineProperty;var u=(e,t)=>Oe(e,"name",{value:t,configurable:!0});import{createRequire as Pe}from"node:module";import{createHash as Ne,randomBytes as Me,randomUUID a...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

release/dist-server/server/modules/browser-use/browser-use.service.jsView on unpkg · L1

release/dist-server/server/modules/providers/list/cursor/cursor-sessions.provider.jsView file

1var U=Object.defineProperty;var I=(e,o)=>U(e,"name",{value:o,configurable:!0});import F from"node:crypto";import L from"node:os";import E from"node:path";import{parseFilesInputTag ...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

release/dist-server/server/modules/providers/list/cursor/cursor-sessions.provider.jsView on unpkg · L1

release/dist-server/server/modules/system/system.module.jsView file

1var f=Object.defineProperty;var o=(e,r)=>f(e,"name",{value:r,configurable:!0});import w from"node:fs";import m from"node:os";import u from"node:path";import l from"cross-spawn";imp...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

release/dist-server/server/modules/system/system.module.jsView on unpkg · L1

scripts/windows-pidusage.exeView file

•path = scripts/windows-pidusage.exe kind = native_binary sizeBytes = 133120 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

scripts/windows-pidusage.exeView on unpkg

release/dist/windcli-browser-bridge.zipView file

•path = release/dist/windcli-browser-bridge.zip kind = high_entropy_blob sizeBytes = 81235 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

release/dist/windcli-browser-bridge.zipView on unpkg

•path = release/dist/windcli-browser-bridge.zip kind = compressed_blob sizeBytes = 81235 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

release/dist/windcli-browser-bridge.zipView on unpkg

•path = release/dist/windcli-browser-bridge.zip kind = nested_archive_needs_inspection sizeBytes = 81235 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

release/dist/windcli-browser-bridge.zipView on unpkg

release/dist/assets/chunk-GF5L2VYU-jBnA74cQ.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

release/dist/assets/chunk-GF5L2VYU-jBnA74cQ.js#virtual:normalized:round1View on unpkg

release/dist/assets/common-CvdMNM4z.jsView file

1patternName = github_pat severity = critical line = 1

Critical

Secret Pattern

GitHub personal access token in release/dist/assets/common-CvdMNM4z.js

release/dist/assets/common-CvdMNM4z.jsView on unpkg · L1

release/dist/assets/common-aa-F3pKQ.jsView file

1patternName = github_pat severity = critical line = 1

Critical

Secret Pattern

GitHub personal access token in release/dist/assets/common-aa-F3pKQ.js

release/dist/assets/common-aa-F3pKQ.jsView on unpkg · L1

release/dist/assets/index-C9Y4ykyB.jsView file

1patternName = github_pat severity = critical line = 1

Critical

Secret Pattern

GitHub personal access token in release/dist/assets/index-C9Y4ykyB.js

release/dist/assets/index-C9Y4ykyB.jsView on unpkg · L1

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in release/dist/assets/index-C9Y4ykyB.js

release/dist/assets/index-C9Y4ykyB.jsView on unpkg · L1

release/dist/assets/auth-D_1JKiAd.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in release/dist/assets/auth-D_1JKiAd.js

release/dist/assets/auth-D_1JKiAd.jsView on unpkg · L1

release/dist/assets/auth-Ccg7155Q.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in release/dist/assets/auth-Ccg7155Q.js

release/dist/assets/auth-Ccg7155Q.jsView on unpkg · L1

release/dist/assets/common-DFjOIvLC.jsView file

1patternName = github_pat severity = critical line = 1

Critical

Secret Pattern

GitHub personal access token in release/dist/assets/common-DFjOIvLC.js

release/dist/assets/common-DFjOIvLC.jsView on unpkg · L1

release/dist/assets/common-DYLsXN9b.jsView file

1patternName = github_pat severity = critical line = 1

Critical

Secret Pattern

GitHub personal access token in release/dist/assets/common-DYLsXN9b.js

release/dist/assets/common-DYLsXN9b.jsView on unpkg · L1

release/dist/assets/auth-inarzBdD.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in release/dist/assets/auth-inarzBdD.js

release/dist/assets/auth-inarzBdD.jsView on unpkg · L1

release/dist/assets/common-BwJZhc81.jsView file

1patternName = github_pat severity = critical line = 1

Critical

Secret Pattern

GitHub personal access token in release/dist/assets/common-BwJZhc81.js

release/dist/assets/common-BwJZhc81.jsView on unpkg · L1

release/dist/assets/common-ClXrYLNn.jsView file

1patternName = github_pat severity = critical line = 1

Critical

Secret Pattern

GitHub personal access token in release/dist/assets/common-ClXrYLNn.js

release/dist/assets/common-ClXrYLNn.jsView on unpkg · L1

release/dist/assets/auth-DOziQUxR.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in release/dist/assets/auth-DOziQUxR.js

release/dist/assets/auth-DOziQUxR.jsView on unpkg · L1

release/dist/assets/common-mkBN4WBT.jsView file

1patternName = github_pat severity = critical line = 1

Critical

Secret Pattern

GitHub personal access token in release/dist/assets/common-mkBN4WBT.js

release/dist/assets/common-mkBN4WBT.jsView on unpkg · L1

release/dist/assets/AppContent-C22ccaJL.jsView file

1patternName = github_pat severity = critical line = 1

Critical

Secret Pattern

GitHub personal access token in release/dist/assets/AppContent-C22ccaJL.js

release/dist/assets/AppContent-C22ccaJL.jsView on unpkg · L1

release/dist/assets/auth-CWVN6QOL.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in release/dist/assets/auth-CWVN6QOL.js

release/dist/assets/auth-CWVN6QOL.jsView on unpkg · L1

release/dist/assets/auth-CLoYH2yJ.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in release/dist/assets/auth-CLoYH2yJ.js

release/dist/assets/auth-CLoYH2yJ.jsView on unpkg · L1

release/dist/assets/common-D4WZnzOL.jsView file

1patternName = github_pat severity = critical line = 1

Critical

Secret Pattern

GitHub personal access token in release/dist/assets/common-D4WZnzOL.js

release/dist/assets/common-D4WZnzOL.jsView on unpkg · L1

release/dist/assets/common-AIXeQ_qy.jsView file

1patternName = github_pat severity = critical line = 1

Critical

Secret Pattern

GitHub personal access token in release/dist/assets/common-AIXeQ_qy.js

release/dist/assets/common-AIXeQ_qy.jsView on unpkg · L1

release/dist/assets/auth-Cg6q9Dn1.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in release/dist/assets/auth-Cg6q9Dn1.js

release/dist/assets/auth-Cg6q9Dn1.jsView on unpkg · L1

release/dist/assets/auth-CD4b5eZk.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in release/dist/assets/auth-CD4b5eZk.js

release/dist/assets/auth-CD4b5eZk.jsView on unpkg · L1

release/dist/assets/auth-BBD9NmvB.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in release/dist/assets/auth-BBD9NmvB.js

release/dist/assets/auth-BBD9NmvB.jsView on unpkg · L1

release/dist/assets/auth-DrFtwGTG.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in release/dist/assets/auth-DrFtwGTG.js

release/dist/assets/auth-DrFtwGTG.jsView on unpkg · L1

Source & flagged code

37 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-node-pty.js && node scripts/fix-pm2-windows-console.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/fix-node-pty.js && node scripts/fix-pm2-windows-console.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•Remote tarball dependency specs: windbrowser-mcp@https://github.[redacted]-v0.1.2/windbrowser-mcp-0.1.2.tgz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

release/dist/assets/common-DNF7JDgr.jsView file

Findings

13 Critical5 High19 Medium9 Low

CriticalCritical Secretrelease/dist/assets/common-DNF7JDgr.js

CriticalSecret Patternrelease/dist/assets/common-DNF7JDgr.js

CriticalSecret Patternrelease/dist/assets/common-CvdMNM4z.js

CriticalSecret Patternrelease/dist/assets/common-aa-F3pKQ.js

CriticalSecret Patternrelease/dist/assets/index-C9Y4ykyB.js

CriticalSecret Patternrelease/dist/assets/common-DFjOIvLC.js

CriticalSecret Patternrelease/dist/assets/common-DYLsXN9b.js

CriticalSecret Patternrelease/dist/assets/common-BwJZhc81.js

CriticalSecret Patternrelease/dist/assets/common-ClXrYLNn.js

CriticalSecret Patternrelease/dist/assets/common-mkBN4WBT.js

Critical

Affected versions and remediation

This report applies to wind-agent-cli@1.47.4.

See all versions of wind-agent-cli for other recorded verdicts.

Review the evidence and your use of wind-agent-cli@1.47.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 03:07:32.992Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.