registry / @desplega.ai/agent-fs / 0.13.7
@desplega.ai/agent-fs@0.13.7
Agent-first filesystem backed by S3
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection shows a user-run CLI with publisher-only scripts and first-party local config, not an install-time attack. Shell, network, and native helper use stay inside explicit agent-fs commands and caller-supplied endpoints.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
No install-time or import-time trigger; behavior starts only when a user runs the agent-fs command.
Impact
No unconsented credential theft, remote payload execution, persistence, or broad agent-config mutation was found.
Mechanism
The CLI reads and writes its own config under ~/.agent-fs and talks to a local or caller-configured API and storage endpoint.
AI rationale
Static inspection shows a user-run CLI with publisher-only scripts and first-party local config, not an install-time attack. Shell, network, and native helper use stay inside explicit agent-fs commands and caller-supplied endpoints.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines no preinstall, install, or postinstall hook; the only script is prepublishOnly for the publisher build.
- The agent-fs bin entry points at dist/cli.js, which starts only when a user runs the CLI.
- Runtime state is written under AGENT_FS_HOME or ~/.agent-fs, including config.json, and the default server binds to 127.0.0.1.
- Optional fuse packages are same-vendor, version-pinned native helpers, not a runtime dependency on this package name.
Evidence against
- child_process and fetch appear only inside user-invoked CLI paths such as onboard, the fuse helper, and the caller-configured API client.
- No code writes foreign agent config files such as Claude or Cursor settings, and no credential is sent to a hidden package-controlled host.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/cli.jsView file
223ORDER BY distance
L224: LIMIT ?`).all(r,t,JSON.stringify([...s]),Math.min(c,Ow));if(d.length===0)break;let l=e.select({id:Y.id,path:Y.filePath,content:Y.content,author:_.author,modifiedAt:_.modifiedAt}).f...
L225: ]))`;continue}else if(n[c]==="$"){o+=`($|(?=[\r
...
L227: `:`[${n[c]}\r
L228: ]`;continue}if(o+=n[c],n[c]==="\\")i=!0;else if(s&&n[c]==="]")s=!1;else if(!s&&n[c]==="[")s=!0}try{new RegExp(o)}catch{return console.warn(`Could not convert regex pattern at ${t.c...
L229: Start a daemon with \`agent-fs daemon start\` or set AGENT_FS_API_URL to connect to a remote server.`),process.exit(1)}Zs=new eI({name:"agent-fs",version:Be},{capabilities:{tools:{...
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L2233var ff=Object.create;var{getPrototypeOf:gf,defineProperty:Io,getOwnPropertyNames:hf}=Object;var ia=Object.prototype.hasOwnProperty;function yf(e){return this[e]}var vf,wf,Ke=(e,t,r...
L4: Install with: brew install sqlite`)}var sa=!1;var aa=m(()=>{_f()});import{mkdirSync as Tf,readFileSync as Cf,writeFileSync as So,existsSync as da}from"fs";import{join as Cr}from"pa...
L5: CREATE TABLE IF NOT EXISTS users (
...
L189: ${Ct.toHex(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let o of e.split("/")){if(o?.length===0)continue;if(o===".")continue;if(o==="..")t.pop();else t.push(...
L190: `);return this.signString(f,{signingDate:r,signingRegion:s,signingService:i})}async signMessage(e,{signingDate:t=new Date,signingRegion:r,signingService:n}){return this.signEvent({...
L
Critical
Findings
3 Critical5 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.13.7.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.13.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.