registry / @desplega.ai/agent-fs / 0.13.10
@desplega.ai/agent-fs@0.13.10
Agent-first filesystem backed by S3
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found no lifecycle hook or concrete malicious behavior. The observed network telemetry and onboarding shell checks are package-aligned and user-activated.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes the CLI or starts its server.
Impact
No unconsented install-time execution, credential theft, destructive action, or agent-control mutation was found.
Mechanism
Commands configure local storage, optional Docker-based onboarding, and service functions; telemetry uses a generated identifier and aggregate service events.
AI rationale
Static inspection found no lifecycle hook or concrete malicious behavior. The observed network telemetry and onboarding shell checks are package-aligned and user-activated.
Evidence
dist/cli.js
Network endpoints1
proxy.desplega.sh/v1/events
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI entrypoint and has only a publish-time build script, with no install lifecycle hook.
- The bundled entrypoint registers CLI commands and parses command-line input.
- Telemetry honors opt-out environment settings and uses a generated installation identifier.
- The observed Docker checks belong to the explicit onboarding command.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/cli.jsView file
223ORDER BY distance
L224: LIMIT ?`).all(r,t,JSON.stringify([...i]),Math.min(c,ob));if(d.length===0)break;let l=e.select({id:Y.id,path:Y.filePath,content:Y.content,author:_.author,modifiedAt:_.modifiedAt}).f...
L225: ]))`;continue}else if(n[c]==="$"){o+=`($|(?=[\r
...
L227: `:`[${n[c]}\r
L228: ]`;continue}if(o+=n[c],n[c]==="\\")s=!0;else if(i&&n[c]==="]")i=!1;else if(!i&&n[c]==="[")i=!0}try{new RegExp(o)}catch{return console.warn(`Could not convert regex pattern at ${t.c...
L229: Start a daemon with \`agent-fs daemon start\` or set AGENT_FS_API_URL to connect to a remote server.`),process.exit(1)}aa=new _I({name:"agent-fs",version:ke},{capabilities:{tools:{...
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L2233var Cf=Object.create;var{getPrototypeOf:Of,defineProperty:Co,getOwnPropertyNames:Nf}=Object;var fa=Object.prototype.hasOwnProperty;function Pf(e){return this[e]}var kf,Df,Ve=(e,t,r...
L4: Install with: brew install sqlite`)}var ga=!1;var ha=m(()=>{Bf()});import{mkdirSync as qf,readFileSync as Kf,writeFileSync as Oo,existsSync as va}from"fs";import{join as Nr}from"pa...
L5: CREATE TABLE IF NOT EXISTS users (
...
L178: END;
L179: `;function Sa(e){if(!e.prepare("PRAGMA table_info(users)").all().some((o)=>o.name==="display_name"))e.exec("ALTER TABLE users ADD COLUMN display_name TEXT");if(!e.prepare("PRAGMA t...
L180: ${this.getCanonicalPath(e)}
...
L189: ${Ot.toHex(s)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let o of e.split("/")){if(o?.length===0)continue;if(o==="
Critical
Findings
3 Critical5 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.13.10.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.13.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.