registry / @desplega.ai/agent-fs / 0.15.0
@desplega.ai/agent-fs@0.15.0
Agent-first filesystem backed by S3
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected source shows package-aligned filesystem operations, explicit command activation, and aggregate telemetry with opt-out controls. No concrete malicious behavior was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Users invoke CLI commands; installation has no preinstall, install, or postinstall trigger.
Impact
The inspected behavior provides the requested filesystem functionality; no credential theft, foreign agent configuration mutation, or malicious execution was established.
Mechanism
Commands manage storage, authenticate to the configured service, launch local helpers, and send aggregate vendor telemetry.
AI rationale
Inspected source shows package-aligned filesystem operations, explicit command activation, and aggregate telemetry with opt-out controls. No concrete malicious behavior was found.
Network endpoints2
proxy.desplega.sh/v1/eventslocalhost:9000
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares build and prepublish scripts, with no registry-install lifecycle hooks or runtime self-dependency.
- The CLI starts MCP and HTTP servers through explicit command handlers.
- Telemetry collects aggregate counts and platform metadata and honors telemetry opt-out settings.
- The API client uses agent-fs credentials to authenticate to the configured agent-fs server.
- FUSE mounting launches a configured or package-provided helper and rejects detected manifest hash mismatches.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/cli.jsView file
272ORDER BY distance
L273: LIMIT ?`).all(r,t,JSON.stringify([...s]),Math.min(d,xx));if(c.length===0)break;let l=e.select({id:te.id,path:te.filePath,content:te.content,author:D.author,modifiedAt:D.modifiedAt}...
L274: (${A.path} >= ${d} AND ${A.path} < ${l})
...
L280: `:`[${n[d]}\r
L281: ]`;continue}if(o+=n[d],n[d]==="\\")i=!0;else if(s&&n[d]==="]")s=!1;else if(!s&&n[d]==="[")s=!0}try{new RegExp(o)}catch{return console.warn(`Could not convert regex pattern at ${t.c...
L282: data: {"driveId":"drive-id","at":"2026-09-30T12:00:00.000Z"}
...
L285:
L286: `}},"x-sse-events":{ready:{type:"object",required:["driveId","at"],properties:{driveId:{type:"string"},at:{type:"string",format:"date-time"}}},"file.changed":{type:"object",require...
L287: Start a daemon with \`agent-fs daemon start\` or se
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L2723var Kh=Object.create;var{getPrototypeOf:Gh,defineProperty:Ai,getOwnPropertyNames:zh}=Object;var Dd=Object.prototype.hasOwnProperty;function Xh(e){return this[e]}var Wh,Yh,tt=(e,t,r...
L4: Install with: brew install sqlite`)}var Ld=!1;var $d=m(()=>{oy()});import{mkdirSync as iy,readFileSync as sy,writeFileSync as Ri,existsSync as Ud}from"fs";import{join as tn}from"pa...
L5: CREATE TABLE IF NOT EXISTS users (
...
L227: END;
L228: `;function qd(e){if(!e.prepare("PRAGMA table_info(users)").all().some((i)=>i.name==="display_name"))e.exec("ALTER TABLE users ADD COLUMN display_name TEXT");if(!e.prepare("PRAGMA t...
L229: ${this.getCanonicalPath(e)}
...
L238: ${qt.toHex(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let o of e.split("/")){if(o?.length===0)continue;if(o==="
Findings
3 Critical6 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
HighSemantic Analysis Limiteddist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Low
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.15.0.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.15.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.