workwayz@1.0.2
Workwayz - All-in-One AI-Powered Project & Portfolio Management Platform for Small & Medium Businesses
AI Security Review
scanned 3h ago · by lpm-firewall-aiThe flagged CLI hook supports loading the packaged Next.js app, and the reviewed account and GitHub actions are request-driven application features. No install-time data collection or automatic credential exfiltration was found in the inspected paths.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The CLI starts the app server; application routes run in response to requests.
Impact
No package-level malicious behavior was identified.
Mechanism
The CLI preloads a resolver compatibility hook. The reviewed report route sends a user-submitted error report to GitHub when configured, and the Firebase purge route authenticates the supplied account before deletion.
AI rationale
The flagged CLI hook supports loading the packaged Next.js app, and the reviewed account and GitHub actions are request-driven application features. No install-time data collection or automatic credential exfiltration was found in the inspected paths.
Network endpoints2
api.github.comidentitytoolkit.googleapis.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes a CLI that starts its bundled Next.js server.
- The resolver hook only retries module resolution after a module-not-found error, mapping hashed dependency names to their original package names.
- GitHub issue creation is invoked by an application error-report request and requires a configured GITHUB_TOKEN; the destination defaults to the Workwayz repository.
Evidence against
- The Firebase purge route requires an email and password, authenticates them with Firebase, and deletes the account only after that authentication succeeds.
- The package manifest contains application scripts but no install, preinstall, or postinstall hook.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStrings
Source & flagged code
8 flagged.next/server/chunks/ssr/src_app_(app)_portfolio-settings_test-data-studio_page_tsx_09yuvie._.jsView file
1patternName = generic_password
severity = medium
line = 1
Medium
Secret Pattern
Package contains a possible secret pattern.
.next/server/chunks/ssr/src_app_(app)_portfolio-settings_test-data-studio_page_tsx_09yuvie._.jsView on unpkg · L1.next/server/app/apple-icon.png.bodyView file
•path = .next/server/app/apple-icon.png.body
kind = high_entropy_blob
sizeBytes = 78797
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
.next/server/app/apple-icon.png.bodyView on unpkg•
Findings
3 High7 Medium3 Low
HighShips High Entropy Blob.next/server/app/apple-icon.png.body
HighPayload In Excluded Dir.next/server/app/apple-icon.png.body
HighPrevious Version Dangerous Deltabin/workwayz.js
MediumSecret Pattern.next/server/chunks/ssr/src_app_(app)_portfolio-settings_test-data-studio_page_tsx_09yuvie._.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Pattern.next/server/chunks/ssr/src_app_(app)_users_page_tsx_1y8y_8-._.js
MediumSecret Pattern.next/server/chunks/_1r1gd97._.js
MediumSecret Pattern.next/static/chunks/0un6mjuwj_-t8.js
MediumSecret Pattern.next/static/chunks/256e2lwgov9-j.js
LowScripts Present
Low
Affected versions and remediation
This report applies to workwayz@1.0.2.
See all versions of workwayz for other recorded verdicts.
- Review the evidence and your use of workwayz@1.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.