registry / @desplega.ai/agent-fs / 0.16.5
@desplega.ai/agent-fs@0.16.5
Agent-first filesystem backed by S3
AI Security Review
scanned 19d ago · by lpm-firewall-aiSource inspection found a prepublish-only build hook and runtime telemetry that is anonymous, package-aligned, and opt-out capable. The scanner’s shell and network matches did not establish an attack path.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user starts the agent-fs server or daemon.
Impact
The inspected telemetry exposes basic product usage and configuration metrics; no credential transfer or install-time mutation was established.
Mechanism
The server sends an anonymous install identifier, aggregate usage counts, and configuration categories to the vendor telemetry endpoint; environment opt-outs disable telemetry.
AI rationale
Source inspection found a prepublish-only build hook and runtime telemetry that is anonymous, package-aligned, and opt-out capable. The scanner’s shell and network matches did not establish an attack path.
Evidence
package.jsondist/cli.js
Network endpoints1
proxy.desplega.sh/v1/events
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines only a prepublish build hook; it does not define an install hook.
- The bundle disables telemetry when either supported opt-out is set and otherwise labels events anonymous.
- Server telemetry sends an anonymous install identifier and aggregate usage and configuration metrics.
- The telemetry endpoint is the vendor proxy, and the telemetry function is called during server startup.
Evidence against
- The scanner’s network and shell findings resolve to anonymous runtime telemetry and Docker checks/setup in the explicit onboarding flow; inspected source did not establish credential export or install-time attack behavior.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/cli.jsView file
309`:`[${n[d]}\r
L310: ]`;continue}if(o+=n[d],n[d]==="\\")i=!0;else if(s&&n[d]==="]")s=!1;else if(!s&&n[d]==="[")s=!0}try{new RegExp(o)}catch{return console.warn(`Could not convert regex pattern at ${t.c...
L311: data: {"driveId":"drive-id","at":"2026-09-30T12:00:00.000Z"}
...
L314:
L315: `}},"x-sse-events":{ready:{type:"object",required:["driveId","at"],properties:{driveId:{type:"string"},at:{type:"string",format:"date-time"}}},"file.changed":{type:"object",require...
L316: Start a daemon with \`agent-fs daemon start\` or set AGENT_FS_API_URL to connect to a remote server.`),process.exit(1)}Xd=new $R({name:"agent-fs",version:Ve},{capabilities:{tools:{...
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L3093var Xy=Object.create;var{getPrototypeOf:Yy,defineProperty:Ji,getOwnPropertyNames:Jy}=Object;var uc=Object.prototype.hasOwnProperty;function Qy(e){return this[e]}var Zy,ev,it=(e,t,r...
L4: Install with: brew install sqlite`)}var pc=!1;var mc=f(()=>{dv()});import{mkdirSync as cv,readFileSync as lv,writeFileSync as Qi,existsSync as gc}from"fs";import{join as hn}from"pa...
L5: CREATE TABLE IF NOT EXISTS users (
...
L247: END;
L248: `;function bc(e){if(!e.prepare("PRAGMA table_info(users)").all().some((s)=>s.name==="display_name"))e.exec("ALTER TABLE users ADD COLUMN display_name TEXT");if(e.exec("CREATE INDEX...
L249: ${this.getCanonicalPath(e)}
...
L258: ${Jt.toHex(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let o of e.split("/")){if(o?.length===0)continue;if(o==="
Critical
Findings
3 Critical6 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
HighSemantic Analysis Limiteddist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Low
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.16.5.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.16.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.