registry / @adithyasak/t3 / 0.1.2-adi.2
@adithyasak/t3@0.1.2-adi.2
Node.js WebSocket server for the T3 Code app.
AI Security Review
scanned 12d ago · by lpm-firewall-aiSource inspection resolved the highlighted process and dynamic-code findings as user-invoked CLI behavior and generated schema validation. No concrete attack behavior was established.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes the installed command or an agent calls the worker's Bash tool with a command.
Impact
The inspected code supports command-line and agent operations; no unrelated credential transfer or other concrete attack was established.
Mechanism
The launcher dispatches when run as the CLI entry point; the worker runs the supplied command in a local Bash process and removes Anthropic environment variables from that process environment.
AI rationale
Source inspection resolved the highlighted process and dynamic-code findings as user-invoked CLI behavior and generated schema validation. No concrete attack behavior was established.
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI executable and dependencies; inspection found no npm lifecycle scripts.
- The launcher dispatches CLI commands only when the executable is invoked as the entry point.
- The worker exposes a Bash tool that runs a supplied command and removes Anthropic environment variables from the shell environment.
- The flagged dynamic Function call compiles generated schema validation code; the inspected API client accepts normal Anthropic configuration.
- The cited dependency modules and manifests identify Effect, the Anthropic agent SDK, and the Cursor SDK.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
12 flaggeddist/claudeHistoryWorker-Dh6fwOGe.mjsView file
11import { randomUUID } from "node:crypto";
L12: import * as sw from "node:child_process";
L13: import { execFile } from "node:child_process";
...
L21: import Pxe, { promisify as promisify$1 } from "util";
L22: import Gxe from "http";
L23: import Wxe from "https";
...
L187: function U(e, t, n, r, o) {
L188: if (r === "m") throw TypeError("Private method is not writable");
L189: if (r === "a" && !o) throw TypeError("Private accessor was defined without a setter");
...
L323: try {
L324: return JSON.parse(e);
L325: } catch (t) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/claudeHistoryWorker-Dh6fwOGe.mjsView on unpkg · L1111import { randomUUID } from "node:crypto";
L12: import * as sw from "node:child_process";
L13: import { execFile } from "node:child_process";
...
L21: import Pxe, { promisify as promisify$1 } from "util";
L22: import Gxe from "http";
L23: import Wxe from "https";
...
L187: function U(e, t, n, r, o) {
L188: if (r === "m") throw TypeError("Private method is not writable");
L189: if (r === "a" && !o) throw TypeError("Private accessor was defined without a setter");
...
L323: try {
L324: return JSON.parse(e);
L325: } catch (t) {
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
dist/claudeHistoryWorker-Dh6fwOGe.mjsView on unpkg · L11Findings
2 Critical7 High6 Medium5 Low
CriticalCredential Exfiltrationdist/claudeHistoryWorker-Dh6fwOGe.mjs
CriticalReverse Shelldist/claudeHistoryWorker-Dh6fwOGe.mjs
HighChild Processdist/claudeHistoryWorker-Dh6fwOGe.mjs
HighShell
HighEvaldist/claudeHistoryWorker-Dh6fwOGe.mjs
HighCommand Output Exfiltrationdist/claudeHistoryWorker-Dh6fwOGe.mjs
HighCloud Metadata Accessdist/claudeHistoryWorker-Dh6fwOGe.mjs
HighObfuscated Payload Loaderdist/claudeHistoryWorker-Dh6fwOGe.mjs
HighRemote Agent Bridgedist/claudeHistoryWorker-Dh6fwOGe.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduledist/client/assets/ghostty-vt-DdA0Zryv.wasm
Affected versions and remediation
This report applies to @adithyasak/t3@0.1.2-adi.2.
See all versions of @adithyasak/t3 for other recorded verdicts.
- Review the evidence and your use of @adithyasak/t3@0.1.2-adi.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.