registry / @desplega.ai/agent-fs / 0.18.0
@desplega.ai/agent-fs@0.18.0
Agent-first filesystem backed by S3
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe package entrypoint is a CLI, and its only lifecycle hook builds the published bundle. The bundle’s default telemetry sends an anonymous identifier and aggregate metrics to the vendor endpoint, with environment-variable opt-outs; the inspected source does not establish credential exfiltration or another concrete attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Starting the API server activates telemetry unless an opt-out environment variable is set.
Impact
The inspected behavior discloses limited operational metrics; it does not send credentials or command output.
Mechanism
Telemetry sends an anonymous install identifier and aggregate service and platform details to the configured vendor endpoint.
AI rationale
The package entrypoint is a CLI, and its only lifecycle hook builds the published bundle. The bundle’s default telemetry sends an anonymous identifier and aggregate metrics to the vendor endpoint, with environment-variable opt-outs; the inspected source does not establish credential exfiltration or another concrete attack.
Evidence
package.jsondist/cli.js
Network endpoints1
proxy.desplega.sh/v1/events
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes dist/cli.js as the command-line entrypoint and defines only a prepublishOnly build hook.
- Telemetry is disabled when ANONYMIZED_TELEMETRY or DO_NOT_TRACK is set to a recognized false value.
- When enabled, telemetry sends an anonymous install identifier and aggregate service counts, provider types, and platform details; the payload contains no credential fields.
- The telemetry endpoint is the package vendor’s proxy, and the server starts telemetry with the API server.
- The Docker commands are part of the explicit onboard setup path for local MinIO.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/cli.jsView file
688};
L689: `,tg;var gd=f(()=>{tg=new WeakMap});import{and as ng,eq as ji,inArray as vA}from"drizzle-orm";async function Hi(e,t,r,n){let o=e.$client,i=[],s=new Set;while(i.length<n){let a=Math...
L690: (${C.path} >= ${d} AND ${C.path} < ${l})
...
L696: `:`[${n[d]}\r
L697: ]`;continue}if(o+=n[d],n[d]==="\\")i=!0;else if(s&&n[d]==="]")s=!1;else if(!s&&n[d]==="[")s=!0}try{new RegExp(o)}catch{return console.warn(`Could not convert regex pattern at ${t.c...
L698: data: {"driveId":"drive-id","at":"2026-09-30T12:00:00.000Z"}
...
L701:
L702: `}},"x-sse-events":{ready:{type:"object",required:["driveId","at"],properties:{driveId:{type:"string"},at:{type:"string",format:"date-time"}}},"file.changed":{type:"object",require...
L703: Start a daemon with \`agent-fs daemon start\` or set AGENT_FS_API_
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L6883var tb=Object.create;var{getPrototypeOf:rb,defineProperty:As,getOwnPropertyNames:nb}=Object;var tl=Object.prototype.hasOwnProperty;function ob(e){return this[e]}var ib,sb,dt=(e,t,r...
L4: Install with: brew install sqlite`)}var rl=!1;var nl=f(()=>{fb()});import{mkdirSync as gb,readFileSync as hb,writeFileSync as Rs,existsSync as ol}from"fs";import{join as Cn}from"pa...
L5: CREATE TABLE IF NOT EXISTS users (
...
L254: DELETE FROM meta WHERE key = 'vec_int8_index';
L255: `),!Nn(n))n.exec(Go);return cl(n),_b(n,{schema:ae})}var me=f(()=>{nl();At();sl();jr()});var fl;var pl=f(()=>{fl={name:"agent-fs",version:"0.18.0",packageManager:"bun@1.4.1",private...
L256: ${this.getCanonicalPath(e)}
...
L265: ${Qt.toHex(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let o of e.spli
Findings
3 Critical5 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.18.0.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.18.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.