registry / @desplega.ai/agent-fs / 0.17.2
@desplega.ai/agent-fs@0.17.2
Agent-first filesystem backed by S3
AI Security Review
scanned 19d ago · by lpm-firewall-aiSource inspection found no concrete malicious behavior. The scanner’s network and process-execution matches correspond to anonymous package-aligned server telemetry and CLI setup or daemon operations.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Telemetry runs when the server starts and on periodic heartbeats; the CLI is activated by a user invoking it.
Impact
No confirmed attack impact; telemetry reports aggregate usage and service configuration.
Mechanism
Telemetry sends anonymous event metadata and aggregate service counts to the Desplega telemetry endpoint, with an environment-variable opt-out.
AI rationale
Source inspection found no concrete malicious behavior. The scanner’s network and process-execution matches correspond to anonymous package-aligned server telemetry and CLI setup or daemon operations.
Evidence
package.jsondist/cli.js
Network endpoints1
proxy.desplega.sh/v1/events
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes dist/cli.js as a CLI and has only a prepublishOnly build hook.
- The CLI provides an environment-variable opt-out for telemetry.
- Telemetry sends anonymous events with version and aggregate service counts; its endpoint is the package publisher’s Desplega domain.
- The telemetry code is called for server-start and periodic heartbeat events, and sends are best-effort.
- Child-process use appears in daemon and user-invoked onboarding setup paths.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/cli.jsView file
346`:`[${n[d]}\r
L347: ]`;continue}if(o+=n[d],n[d]==="\\")i=!0;else if(s&&n[d]==="]")s=!1;else if(!s&&n[d]==="[")s=!0}try{new RegExp(o)}catch{return console.warn(`Could not convert regex pattern at ${t.c...
L348: data: {"driveId":"drive-id","at":"2026-09-30T12:00:00.000Z"}
...
L351:
L352: `}},"x-sse-events":{ready:{type:"object",required:["driveId","at"],properties:{driveId:{type:"string"},at:{type:"string",format:"date-time"}}},"file.changed":{type:"object",require...
L353: Start a daemon with \`agent-fs daemon start\` or set AGENT_FS_API_URL to connect to a remote server.`),process.exit(1)}uc=new FT({name:"agent-fs",version:Ve},{capabilities:{tools:{...
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L3463var Av=Object.create;var{getPrototypeOf:Rv,defineProperty:os,getOwnPropertyNames:Tv}=Object;var Tc=Object.prototype.hasOwnProperty;function _v(e){return this[e]}var kv,Cv,at=(e,t,r...
L4: Install with: brew install sqlite`)}var _c=!1;var kc=f(()=>{Uv()});import{mkdirSync as Fv,readFileSync as jv,writeFileSync as is,existsSync as Oc}from"fs";import{join as vn}from"pa...
L5: CREATE TABLE IF NOT EXISTS users (
...
L251: DELETE FROM meta WHERE key = 'vec_int8_index';
L252: `),!bn(n))n.exec(To);return Mc(n),Jv(n,{schema:de})}var me=f(()=>{kc();St();Dc();_r()});var Hc;var jc=f(()=>{Hc={name:"agent-fs",version:"0.17.2",packageManager:"bun@1.4.1",private...
L253: ${this.getCanonicalPath(e)}
...
L262: ${Qt.toHex(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let o of e.spli
Critical
Findings
3 Critical5 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.17.2.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.17.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.