workwayz@1.0.1
Workwayz - Enterprise-Grade AI-Powered Project & Portfolio Management Platform
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package automatically sends browser error details, page URL, and user-agent information to its own endpoint, which logs them along with client IP. This is undisclosed runtime telemetry, so it warrants a warning; the GitHub issue path is conditional and the automatic reports disable it.
Static reason
One or more suspicious static signals were detected.
Trigger
A browser-side application error occurs.
Impact
Application diagnostics and request context may be retained by the operator without user action.
Mechanism
The client sends error details, page URL, and browser information to `/api/report-issue`; the route logs diagnostic fields, including client IP, in a local rotating log. Automatic reports do not create GitHub issues.
AI rationale
The package automatically sends browser error details, page URL, and user-agent information to its own endpoint, which logs them along with client IP. This is undisclosed runtime telemetry, so it warrants a warning; the GitHub issue path is conditional and the automatic reports disable it.
Evidence
.next/server/chunks/ssr/_09nlcmq._.js.map.next/server/chunks/_149y6sd._.js.maplogs/
Network endpoints2
same-origin /api/report-issueapi.github.com/repos/${owner}/${repo}/issues (conditional issue-report path)
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Automatic browser error reporting sends the page URL and browser user agent to `/api/report-issue`, with GitHub submission disabled.
- The route logs error messages, stacks, component stacks, page URL, user agent, client IP, and email to a local rotating log.
- GitHub issue creation is conditional on `submitToGitHub` being true and `silent` being false.
Evidence against
- The package metadata declares no install lifecycle hook; its scripts are development, build, and test commands.
- The launcher preloads a resolver hook that maps hashed dependency names to their canonical package names.
- Automatic error reports disable GitHub issue creation; the GitHub integration uses the server’s `GITHUB_TOKEN` and defaults to the Workwayz repository.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStrings
Source & flagged code
7 flagged.next/server/chunks/ssr/src_app_(app)_users_page_tsx_1y8y_8-._.jsView file
1patternName = generic_password
severity = medium
line = 1
Medium
Secret Pattern
Package contains a possible secret pattern.
.next/server/chunks/ssr/src_app_(app)_users_page_tsx_1y8y_8-._.jsView on unpkg · L1.next/server/app/apple-icon.png.bodyView file
•path = .next/server/app/apple-icon.png.body
kind = high_entropy_blob
sizeBytes = 78797
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
.next/server/app/apple-icon.png.bodyView on unpkg•path = .next/server/app/apple-icon.png.body
kind = payload_in_excluded_dir
sizeBytes = 78797
magicHex = [redacted]
Findings
2 High7 Medium3 Low
HighShips High Entropy Blob.next/server/app/apple-icon.png.body
HighPayload In Excluded Dir.next/server/app/apple-icon.png.body
MediumSecret Pattern.next/server/chunks/ssr/src_app_(app)_users_page_tsx_1y8y_8-._.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Pattern.next/server/chunks/ssr/src_dev-tools_index_ts_1f0sm6j._.js
MediumSecret Pattern.next/server/chunks/_1r1gd97._.js
MediumSecret Pattern.next/static/chunks/1w2pyx-jx7_0h.js
MediumSecret Pattern.next/static/chunks/261k_gwt613jt.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to workwayz@1.0.1.
See all versions of workwayz for other recorded verdicts.
- Review the evidence and your use of workwayz@1.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.