registry / @desplega.ai/agent-fs / 0.17.3
@desplega.ai/agent-fs@0.17.3
Agent-first filesystem backed by S3
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe manifest’s only lifecycle script builds the package before publishing. The inspected runtime telemetry is anonymous, opt-out-aware, and sent to the vendor domain, so the scanner hints do not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Starting the agent-fs server activates telemetry.
Impact
The inspected behavior supports product telemetry, with no confirmed credential theft or other attack surface.
Mechanism
The CLI sends product events and server metrics to the configured vendor endpoint; the telemetry helper checks opt-out settings.
AI rationale
The manifest’s only lifecycle script builds the package before publishing. The inspected runtime telemetry is anonymous, opt-out-aware, and sent to the vendor domain, so the scanner hints do not establish malicious behavior.
Network endpoints1
proxy.desplega.sh/v1/events
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines only a prepublishOnly build script; it does not define an install-time hook.
- The CLI sends anonymous product events with environment and version metadata, and its telemetry helper checks opt-out settings.
- The telemetry endpoint is on the package vendor’s desplega.sh domain.
- The server startup path invokes the telemetry helper; this is runtime behavior, not an install-time action.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/cli.jsView file
351`:`[${n[d]}\r
L352: ]`;continue}if(o+=n[d],n[d]==="\\")i=!0;else if(s&&n[d]==="]")s=!1;else if(!s&&n[d]==="[")s=!0}try{new RegExp(o)}catch{return console.warn(`Could not convert regex pattern at ${t.c...
L353: data: {"driveId":"drive-id","at":"2026-09-30T12:00:00.000Z"}
...
L356:
L357: `}},"x-sse-events":{ready:{type:"object",required:["driveId","at"],properties:{driveId:{type:"string"},at:{type:"string",format:"date-time"}}},"file.changed":{type:"object",require...
L358: Start a daemon with \`agent-fs daemon start\` or set AGENT_FS_API_URL to connect to a remote server.`),process.exit(1)}pc=new qT({name:"agent-fs",version:Ve},{capabilities:{tools:{...
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L3513var _v=Object.create;var{getPrototypeOf:kv,defineProperty:ss,getOwnPropertyNames:Cv}=Object;var _c=Object.prototype.hasOwnProperty;function Ov(e){return this[e]}var Nv,Dv,at=(e,t,r...
L4: Install with: brew install sqlite`)}var kc=!1;var Cc=f(()=>{Hv()});import{mkdirSync as Bv,readFileSync as qv,writeFileSync as as,existsSync as Nc}from"fs";import{join as En}from"pa...
L5: CREATE TABLE IF NOT EXISTS users (
...
L252: DELETE FROM meta WHERE key = 'vec_int8_index';
L253: `),!Sn(n))n.exec(ko);return $c(n),ew(n,{schema:de})}var me=f(()=>{Cc();At();Pc();Or()});var Bc;var Hc=f(()=>{Bc={name:"agent-fs",version:"0.17.3",packageManager:"bun@1.4.1",private...
L254: ${this.getCanonicalPath(e)}
...
L263: ${Qt.toHex(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let o of e.spli
Critical
Findings
3 Critical5 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.17.3.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.17.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.