registry / @adithyasak/t3 / 0.1.2-adi.1
@adithyasak/t3@0.1.2-adi.1
Node.js WebSocket server for the T3 Code app.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe package manifest exposes a CLI and contains no lifecycle scripts. The scanner’s shell, environment, and dynamic-code matches resolve to bundled agent functionality and an empty-function capability probe; inspected source does not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running the published CLI; the Claude history worker is started for a requested history retrieval or session fork.
Impact
No unauthorized data transfer, destructive action, or persistence was identified.
Mechanism
The worker validates its options and session ID, then retrieves messages or forks the specified session. The inspected source shows no credential transfer or hidden payload execution.
AI rationale
The package manifest exposes a CLI and contains no lifecycle scripts. The scanner’s shell, environment, and dynamic-code matches resolve to bundled agent functionality and an empty-function capability probe; inspected source does not establish malicious behavior.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json publishes a CLI through dist/bin.mjs and declares no install or import lifecycle hook.
- The Claude history worker handles requested message retrieval or session forking; the CLI passes it the requested operation, session ID, and options.
- The new Function match is a capability check that tries an empty function body and catches failure; it does not construct or run a payload.
- The worker’s environment and shell code creates a Bash session for CLI functionality, which explains the process and environment matches.
- The flagged Effect files contain standard runtime, collection, encoding, schema, HTTP-data, and networking helpers; the inspected dependency manifest identifies them as Effect 4.0.5.
- The other inspected dependency paths identify the Claude Agent SDK and Cursor SDK; the Claude SDK export includes session history and fork APIs used by the worker.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystem
Source & flagged code
12 flaggeddist/claudeHistoryWorker-Dh6fwOGe.mjsView file
11import { randomUUID } from "node:crypto";
L12: import * as sw from "node:child_process";
L13: import { execFile } from "node:child_process";
...
L21: import Pxe, { promisify as promisify$1 } from "util";
L22: import Gxe from "http";
L23: import Wxe from "https";
...
L187: function U(e, t, n, r, o) {
L188: if (r === "m") throw TypeError("Private method is not writable");
L189: if (r === "a" && !o) throw TypeError("Private accessor was defined without a setter");
...
L323: try {
L324: return JSON.parse(e);
L325: } catch (t) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/claudeHistoryWorker-Dh6fwOGe.mjsView on unpkg · L1111import { randomUUID } from "node:crypto";
L12: import * as sw from "node:child_process";
L13: import { execFile } from "node:child_process";
...
L21: import Pxe, { promisify as promisify$1 } from "util";
L22: import Gxe from "http";
L23: import Wxe from "https";
...
L187: function U(e, t, n, r, o) {
L188: if (r === "m") throw TypeError("Private method is not writable");
L189: if (r === "a" && !o) throw TypeError("Private accessor was defined without a setter");
...
L323: try {
L324: return JSON.parse(e);
L325: } catch (t) {
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
dist/claudeHistoryWorker-Dh6fwOGe.mjsView on unpkg · L11Findings
2 Critical7 High6 Medium5 Low
CriticalCredential Exfiltrationdist/claudeHistoryWorker-Dh6fwOGe.mjs
CriticalReverse Shelldist/claudeHistoryWorker-Dh6fwOGe.mjs
HighChild Processdist/claudeHistoryWorker-Dh6fwOGe.mjs
HighShell
HighEvaldist/claudeHistoryWorker-Dh6fwOGe.mjs
HighCommand Output Exfiltrationdist/claudeHistoryWorker-Dh6fwOGe.mjs
HighCloud Metadata Accessdist/claudeHistoryWorker-Dh6fwOGe.mjs
HighObfuscated Payload Loaderdist/claudeHistoryWorker-Dh6fwOGe.mjs
HighRemote Agent Bridgedist/claudeHistoryWorker-Dh6fwOGe.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduledist/client/assets/ghostty-vt-DdA0Zryv.wasm
Affected versions and remediation
This report applies to @adithyasak/t3@0.1.2-adi.1.
See all versions of @adithyasak/t3 for other recorded verdicts.
- Review the evidence and your use of @adithyasak/t3@0.1.2-adi.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.