workwayz@8.0.1
Workwayz - Enterprise-Grade AI-Powered Project & Portfolio Management Platform
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe inspected indicators resolve to ordinary application behavior and a structurally valid PNG asset. No malicious transfer, persistence, or install-time behavior was established.
Static reason
One or more suspicious static signals were detected.
Trigger
No install-time trigger is declared; the package exposes a CLI for user invocation.
Impact
No confirmed harmful effect was found in the reviewed behavior.
Mechanism
The reviewed launcher support retries failed module resolution with a canonical dependency name; no harmful execution or data transfer was established.
AI rationale
The inspected indicators resolve to ordinary application behavior and a structurally valid PNG asset. No malicious transfer, persistence, or install-time behavior was established.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json maps two command names to a CLI and lists development, build, and start scripts; it has no install lifecycle hook.
- The app request accepts chat messages and optional project and user context; a server chunk derives content security policy origins from the configured Supabase host.
- A required server chunk imports the Next app-route runtime; the other required dependency chunks show generic file-loading and Supabase session-refresh behavior.
- The flagged binary is identified as a PNG with validated framing and no trailing bytes; the server trace lists the application apple icon as an asset.
- The possible secret match is an optional password field with a minimum-length validation rule, not a literal credential.
- The resolver fallback retries module resolution using the canonical dependency name after the original resolution fails.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStrings
Source & flagged code
7 flagged.next/server/chunks/ssr/src_app_(app)_users_page_tsx_1y8y_8-._.jsView file
1patternName = generic_password
severity = medium
line = 1
Medium
Secret Pattern
Package contains a possible secret pattern.
.next/server/chunks/ssr/src_app_(app)_users_page_tsx_1y8y_8-._.jsView on unpkg · L1.next/server/app/apple-icon.png.bodyView file
•path = .next/server/app/apple-icon.png.body
kind = high_entropy_blob
sizeBytes = 78797
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
.next/server/app/apple-icon.png.bodyView on unpkg•path = .next/server/app/apple-icon.png.body
kind = payload_in_excluded_dir
sizeBytes = 78797
magicHex = [redacted]
Findings
2 High7 Medium3 Low
HighShips High Entropy Blob.next/server/app/apple-icon.png.body
HighPayload In Excluded Dir.next/server/app/apple-icon.png.body
MediumSecret Pattern.next/server/chunks/ssr/src_app_(app)_users_page_tsx_1y8y_8-._.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Pattern.next/server/chunks/ssr/src_dev-tools_index_ts_1f0sm6j._.js
MediumSecret Pattern.next/server/chunks/_1r1gd97._.js
MediumSecret Pattern.next/static/chunks/0gu7oufxrrpul.js
MediumSecret Pattern.next/static/chunks/1m5rkmud-_tu1.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to workwayz@8.0.1.
See all versions of workwayz for other recorded verdicts.
- Review the evidence and your use of workwayz@8.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.