@wix/cli
CLI tool for building Wix sites and applications
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): Wix org internal maintainer addition; consistent with normal team growth for this package. | ai | |
| source-diff | net-exec-file:build/chunk-H5GIJ5WD.js | AI (source-diff): Standard tsup bundle chunk for Wix CLI; network+exec pattern is normal CLI tooling, not malware. | ai | |
| source-diff | obfuscated-file:build/DevCommand-HLUM4POK.js | AI (source-diff): Minified tsup build output; long lines are expected in bundled CLI artifacts. | ai | |
| source-diff | net-exec-file:build/DevCommand-HLUM4POK.js | AI (source-diff): Standard tsup bundle for Wix CLI DevCommand; network+exec pattern is normal CLI tooling, not malware. | ai | |
| source-diff | net-exec-file:build/chunk-YHFCDWGT.js | AI (source-diff): Standard tsup bundle chunk for Wix CLI; network+exec pattern is normal CLI tooling, not malware. | ai | |
| source-diff | net-exec-file:build/chunk-UC4R2FMF.js | AI (source-diff): Standard tsup bundle chunk for Wix CLI; network+exec pattern is normal CLI tooling, not malware. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Wix uses wix-ci-publisher CI automation; named maintainer removal is expected and stable for this package. | ai | |
| source-diff | net-exec-file:build/chunk-GIY7WJPG.js | AI (source-diff): Bundled CLI artifact (tsup); chunk imports are standard ESM shims and known libraries, not dropper behavior. | ai | |
| source-diff | net-exec-file:build/chunk-BMIHF7TV.js | AI (source-diff): Standard bundler output; lodash/spinner/CLI error imports, no exfiltration pattern. | ai | |
| source-diff | net-exec-file:build/chunk-LZK3IDHD.js | AI (source-diff): Standard bundler output; semver/comment-json/verror imports, no exfiltration pattern. | ai | |
| source-diff | net-exec-file:build/chunk-ATM4SPNF.js | AI (source-diff): Standard bundler output (esbuild/tsup chunks) for a Wix CLI tool; imports known libs, not malware. | ai | |
| source-diff | net-exec-file:build/chunk-DWFKVKZR.js | AI (source-diff): Bundled ESM CLI artifact (tsup output); same pattern as other chunks in this build. | ai | |
| source-diff | net-exec-file:build/chunk-SUZH7ZRT.js | AI (source-diff): Bundled ESM CLI artifact (tsup output); same pattern as other chunks in this build. | ai | |
| source-diff | net-exec-file:build/chunk-7VLYVKSJ.js | AI (source-diff): Bundled ESM CLI artifact (tsup output); network+exec pattern is from legitimate CLI tooling, not malware. | ai | |
| source-diff | net-exec-file:build/chunk-2KD37CL6.js | AI (source-diff): Bundled react-dom and OSS libs via tsup; standard CLI build output for @wix/cli. | ai | |
| phantom-deps | phantom-dep:@wix/agent-skills | AI (phantom-deps): Same-org dep; phantom finding is a stable false positive for this package's build structure. | ai | |
| source-diff | net-exec-file:build/chunk-PTKI6YTE.js | AI (source-diff): Bundled wix auth/i18n/UI OSS libs; standard CLI build output. | ai | |
| source-diff | net-exec-file:build/chunk-JUL5P544.js | AI (source-diff): Bundled wix-internal and OSS libs; standard CLI build output. | ai | |
| source-diff | net-exec-file:build/chunk-JEUY7ENC.js | AI (source-diff): Bundled lodash/cli-spinners OSS libs; standard CLI build output. | ai | |
| source-diff | net-exec-file:build/chunk-4UXOYIYC.js | AI (source-diff): Bundled esprima/semver/comment-json OSS libs; standard CLI build output. | ai | |
| source-diff | net-exec-file:build/chunk-HBS77YKL.js | AI (source-diff): Standard tsup/ESBuild bundle chunk for Wix CLI; network+exec pattern is normal CLI tooling, not malware. | ai | |
| source-diff | net-exec-file:build/chunk-HWT3LUJJ.js | AI (source-diff): Bundled CLI output using createRequire shims; network+exec pattern is from bundled deps, not malware. | ai | |
| source-diff | net-exec-file:build/chunk-JNRWJBN3.js | AI (source-diff): Same tsup bundle pattern; imports well-known libs (semver, esprima, comment-json); not malicious. | ai | |
| source-diff | net-exec-file:build/chunk-7ZE77QRA.js | AI (source-diff): Bundled ESM build output from tsup; imports are well-known OSS packages, not malicious loaders. | ai | |
| source-diff | net-exec-file:build/chunk-RXELUXS6.js | AI (source-diff): Bundled ESM build output from tsup; imports are well-known OSS packages, not malicious loaders. | ai | |
| source-diff | net-exec-file:build/chunk-OB256ZCK.js | AI (source-diff): Bundled ESM build output from tsup; imports are well-known OSS packages, not malicious loaders. | ai | |
| source-diff | net-exec-file:build/chunk-F5A2UKXZ.js | AI (source-diff): Standard bundled CLI code with CJS interop; not malware. | ai | |
| source-diff | net-exec-file:build/chunk-QK47PIWK.js | AI (source-diff): Standard bundled CLI code with CJS interop; not malware. | ai | |
| source-diff | net-exec-file:build/chunk-NJ7DBBZC.js | AI (source-diff): Standard bundled CLI code with CJS interop; not malware. | ai | |
| source-diff | net-exec-file:build/chunk-ME2WCIDZ.js | AI (source-diff): Standard bundled CLI code with CJS interop; not malware. | ai | |
| source-diff | obfuscated-file:build/GenerateCommand-DR5HBD2C.js | AI (source-diff): Minified tsup build output for Wix CLI; not obfuscated malware. | ai | |
| source-diff | net-exec-file:build/GenerateCommand-DR5HBD2C.js | AI (source-diff): Bundled CLI command code with legitimate HTTP client usage; not dropper malware. | ai | |
| source-diff | net-exec-file:build/DevCommand-MNDFRYAL.js | AI (source-diff): Bundled CLI command code with legitimate HTTP client and execa usage; not dropper malware. | ai | |
| source-diff | obfuscated-file:build/DevCommand-MNDFRYAL.js | AI (source-diff): Minified tsup build output for Wix CLI; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:build/GenerateCommand-PPUZJQFM.js | AI (source-diff): Minified tsup bundle output for Wix CLI; stable pattern across versions. | ai | |
| provenance | no-provenance | AI (provenance): Established Wix CI publisher with strong track record; provenance not yet enabled but not a blocker. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Wix CLI regularly ships large bundled builds; chunk renaming on each version is expected. | ai | |
| source-diff | net-exec-file:build/GenerateCommand-PPUZJQFM.js | AI (source-diff): CLI tool legitimately uses network calls and dynamic require; bundled from known deps. | ai | |
| source-diff | net-exec-file:build/DevCommand-OH3TIRTJ.js | AI (source-diff): CLI tool legitimately uses network calls and dynamic require; bundled from known deps. | ai | |
| source-diff | net-exec-file:build/chunk-EIQ7XHNY.js | AI (source-diff): CLI tool legitimately uses network calls and dynamic require; bundled from known deps. | ai | |
| source-diff | net-exec-file:build/chunk-5HMDJMVP.js | AI (source-diff): CLI tool legitimately uses network calls and dynamic require; bundled from known deps. | ai | |
| source-diff | obfuscated-file:build/DevCommand-OH3TIRTJ.js | AI (source-diff): Minified tsup bundle output for Wix CLI; stable pattern across versions. | ai | |
| source-diff | net-exec-file:build/chunk-F4637D6J.js | AI (source-diff): Standard tsup/ESM bundle chunk; network calls and require shims are normal CLI tool patterns for this package. | ai | |
| source-diff | net-exec-file:build/chunk-HEVQAPPA.js | AI (source-diff): Standard tsup/ESM bundle chunk; same pattern as other chunks in this well-established Wix CLI package. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): @wix/cli is the official Wix CLI tool; Levenshtein match to 'joi' is a false positive with no squatting intent. | ai |
Versions (showing 18 of 18)
| Version | Deps | Published |
|---|---|---|
| 1.1.207 | 2 / 36 | |
| 1.1.206 | 2 / 36 | |
| 1.1.205 | 2 / 36 | |
| 1.1.203 | 2 / 36 | |
| 1.1.201 | 1 / 36 | |
| 1.1.200 | 1 / 36 | |
| 1.1.199 | 1 / 36 | |
| 1.1.198 | 1 / 36 | |
| 1.1.196 | 1 / 36 | |
| 1.1.195 | 1 / 36 | |
| 1.1.193 | 1 / 36 | |
| 1.1.191 | 1 / 36 | |
| 1.1.182 | 1 / 36 | |
| 1.1.181 | 1 / 36 | |
| 1.1.178 | 1 / 35 | |
| 1.1.177 | 1 / 35 | |
| 1.1.176 | 1 / 35 | |
| 1.1.175 | 1 / 35 |
v1.1.207
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.206
6 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.205
6 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.203
4 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.201
4 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.200
4 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.199
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.198
4 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.196
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.195
6 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.193
5 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.191
4 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.182
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.178
7 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.177
7 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.176
7 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.175
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.