@desplega.ai/agent-fs
Agent-first filesystem backed by S3
This report shows the evidence for @desplega.ai/agent-fs@0.18.15. 0 of 48 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe daemon sends undisclosed runtime telemetry by default, including aggregate database usage, so this warrants a warning. The reviewed credential and command execution signals did not establish exfiltration or malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Starting the agent-fs daemon; telemetry can be disabled with ANONYMIZED_TELEMETRY or DO_NOT_TRACK.
Impact
The vendor receives identifying installation metadata and aggregate usage data without disclosure in the package README.
Mechanism
The daemon generates or reuses an install ID, gathers database counts and provider/platform metadata, and posts startup and heartbeat events.
AI rationale
The daemon sends undisclosed runtime telemetry by default, including aggregate database usage, so this warrants a warning. The reviewed credential and command execution signals did not establish exfiltration or malicious behavior.
Evidence
dist/cli.js~/.agent-fs/config.json
Network endpoints1
proxy.desplega.sh/v1/events
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Starting the daemon enables telemetry by default unless ANONYMIZED_TELEMETRY or DO_NOT_TRACK disables it.
- Telemetry sends a generated install ID, database counts, storage and embedding provider names, OS, and architecture to https://proxy.desplega.sh/v1/events.
- The daemon sends a startup event and periodic heartbeats; the package README does not disclose this telemetry.
Evidence against
- The manifest exposes dist/cli.js as a command-line executable, and its prepublishOnly script only builds that file.
- The reviewed API keys are used with their configured services; no credential exfiltration was identified.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/cli.jsView file
755ELSE 'viewer'
L756: END`}function Pa(e,t){return e.insert(Y).values({orgId:t.orgId,userId:t.userId,role:t.role}).onConflictDoUpdate({target:[Y.orgId,Y.userId],set:{role:Ob(Y.role)}}).returning({role:Y...
L757: ]))`;continue}else if(n[d]==="$"){o+=`($|(?=[\r
...
L764:
L765: `}},"x-sse-events":{"presence.snapshot":{...s,description:"Only sent when presence=1, immediately after ready."},"presence.updated":{type:"object",description:"Only sent when prese...
L766: Start a daemon with \`agent-fs daemon start\` or set AGENT_FS_API_URL to connect to a remote server.`),process.exit(1)}lp=new yD({name:"agent-fs",version:it},{capabilities:{tools:{...
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L7553var hS=Object.create;var{getPrototypeOf:yS,defineProperty:fd,getOwnPropertyNames:vS}=Object;var _p=Object.prototype.hasOwnProperty;function bS(e){return this[e]}var wS,ES,vt=(e,t,r...
L4: Install with: brew install sqlite`)}var Tp=!1;var kp=h(()=>{kS()});import{mkdirSync as OS,readFileSync as CS,writeFileSync as gd,existsSync as Op}from"fs";import{join as ko}from"pa...
L5: CREATE TABLE IF NOT EXISTS org_invites (
...
L294: DELETE FROM meta WHERE key = 'vec_int8_index';
L295: `),!Co(n))n.exec(Qi);return Lp(n),BS(n,{schema:ie})}var le=h(()=>{kp();wt();Cp();$p();bn()});var Bp;var Hp=h(()=>{Bp={name:"agent-fs",version:"0.18.15",packageManager:"bun@1.4.4",p...
L296: ${this.getCanonicalPath(e)}
...
L305: ${Ir.toHex(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let o of
Critical
Findings
3 Critical5 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.18.15.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @desplega.ai/agent-fs@0.18.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.