wrangler-deploy@1.5.5

Summary

Package name wrangler-deploy is close to Cloudflare's official wrangler CLI, which raises confusion-risk concerns for developers who may install it expecting an official Cloudflare tool. Pattern-based signals fired on dist/cli/index.js, dist/core/dev-ui.js, dist/core/runtime.js, dist/core/sandbox-proxy.js, and dist/core/crypto.js based on co-occurrence of keywords like ping, POST/GET, Buffer.from(..., 'base64'), and hostname in minified/bundled code. These keyword patterns are consistent with a Wrangler-shaped CLI (HTTP requests to Cloudflare APIs, dev server, base64 token handling) but cannot be conclusively distinguished from exfiltration patterns without semantic verification of the bundled code. No specific attacker-controlled endpoint, credential-harvest path, install-time lifecycle hook, or dropper has been identified. Routing to human review to verify whether the package is a legitimate Cloudflare-adjacent tool, an unofficial deploy wrapper, or a name-confusion squat with hidden behavior in the minified bundles.

Source: amazon-inspector (0d2085fa4916157b99799df085aa11e3d29bdb9a47f5798c85375b1bfdf8bd7e)