registry / @desplega.ai/agent-fs / 0.13.2
@desplega.ai/agent-fs@0.13.2
Agent-first filesystem backed by S3
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe scanner conflated legitimate configured API, S3, and FUSE functionality with credential exfiltration. Source inspection found no install-time execution, fixed collector, stealth persistence, or unconsented AI-agent control-surface mutation.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs an agent-fs CLI command such as mount or configures a remote agent-fs service.
Impact
It can access configured agent-fs storage and launch its verified helper, consistent with its documented function.
Mechanism
User-invoked filesystem service and optional FUSE helper.
AI rationale
The scanner conflated legitimate configured API, S3, and FUSE functionality with credential exfiltration. Source inspection found no install-time execution, fixed collector, stealth persistence, or unconsented AI-agent control-surface mutation.
Evidence
package.jsondist/cli.jsdist/fuse-bin.manifest.jsonREADME.md
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The explicit mount command can spawn a FUSE helper selected from its companion package or a user-provided path.
Evidence against
- package.json has only a prepublish build hook, not an install-time hook.
- Network requests use a user-configured agent-fs API URL and API key.
- The helper verifies its hash before it is spawned.
- No fixed third-party exfiltration endpoint or agent-control configuration write was found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/cli.jsView file
214ORDER BY distance
L215: LIMIT ?`).all(i,r),c=[],l=new Set;for(let u of a){let p=e.db.select().from(d.contentChunks).where(Di(d.contentChunks.id,u.chunk_id)).get();if(!p||p.driveId!==e.driveId)continue;if(...
L216: ]))`;continue}else if(n[c]==="$"){o+=`($|(?=[\r
...
L218: `:`[${n[c]}\r
L219: ]`;continue}if(o+=n[c],n[c]==="\\")i=!0;else if(s&&n[c]==="]")s=!1;else if(!s&&n[c]==="[")s=!0}try{new RegExp(o)}catch{return console.warn(`Could not convert regex pattern at ${t.c...
L220: Start a daemon with \`agent-fs daemon start\` or set AGENT_FS_API_URL to connect to a remote server.`),process.exit(1)}Fs=new zE({name:"agent-fs",version:Oe},{capabilities:{tools:{...
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L2143var tf=Object.create;var{getPrototypeOf:rf,defineProperty:yo,getOwnPropertyNames:nf}=Object;var of=Object.prototype.hasOwnProperty;function sf(e){return this[e]}var af,cf,De=(e,t,r...
L4: Install with: brew install sqlite`)}var Gs=!1;var zs=f(()=>{ff()});import{mkdirSync as gf,readFileSync as hf,writeFileSync as vo,existsSync as Ws}from"fs";import{join as Sr}from"pa...
L5: CREATE TABLE IF NOT EXISTS users (
...
L188: ${It.toHex(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let o of e.split("/")){if(o?.length===0)continue;if(o===".")continue;if(o==="..")t.pop();else t.push(...
L189: `);return this.signString(g,{signingDate:r,signingRegion:s,signingService:i})}async signMessage(e,{signingDate:t=new Date,signingRegion:r,signingService:n}){return this.signEvent({...
L
Critical
Findings
3 Critical5 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.13.2.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.13.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.