registry / @desplega.ai/agent-fs / 0.18.1
@desplega.ai/agent-fs@0.18.1
Agent-first filesystem backed by S3
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe scanner’s credential and command-output exfiltration labels are not supported by the inspected source. The automatic telemetry is product-aligned, contains aggregate information and an anonymous install identifier, and has effective environment-variable opt-outs, so the source does not establish an attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Starting the API server, unless telemetry is disabled through the supported opt-out environment variables.
Impact
The transfer exposes an anonymous installation identifier and aggregate usage information, but the inspected path does not transmit credentials or command output.
Mechanism
The server sends startup and periodic heartbeat events containing aggregate counts and product configuration details; telemetry checks both opt-out variables before sending.
AI rationale
The scanner’s credential and command-output exfiltration labels are not supported by the inspected source. The automatic telemetry is product-aligned, contains aggregate information and an anonymous install identifier, and has effective environment-variable opt-outs, so the source does not establish an attack.
Evidence
dist/cli.js
Network endpoints1
proxy.desplega.sh/v1/events
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes dist/cli.js as the command entrypoint; prepublishOnly only runs the build script.
- The CLI telemetry path honors ANONYMIZED_TELEMETRY and DO_NOT_TRACK opt-outs.
- Telemetry sends an anonymous install identifier and aggregate product, storage, embedding, platform, and usage data to the vendor event endpoint.
- Telemetry starts with the API server; the inspected request contains no credential or command-output transfer.
Evidence against
- The server sends telemetry automatically unless an opt-out variable is set.
- Telemetry includes a persistent random install identifier and aggregate counts.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/cli.jsView file
701};
L702: `,rg;var gd=g(()=>{rg=new WeakMap});import{and as og,eq as Ui,inArray as yA}from"drizzle-orm";async function Fi(e,t,r,n){let o=e.$client,i=[],s=new Set;while(i.length<n){let a=Math...
L703: (${C.path} >= ${d} AND ${C.path} < ${l})
...
L709: `:`[${n[d]}\r
L710: ]`;continue}if(o+=n[d],n[d]==="\\")i=!0;else if(s&&n[d]==="]")s=!1;else if(!s&&n[d]==="[")s=!0}try{new RegExp(o)}catch{return console.warn(`Could not convert regex pattern at ${t.c...
L711: data: {"driveId":"drive-id","at":"2026-09-30T12:00:00.000Z"}
...
L714:
L715: `}},"x-sse-events":{ready:{type:"object",required:["driveId","at"],properties:{driveId:{type:"string"},at:{type:"string",format:"date-time"}}},"file.changed":{type:"object",require...
L716: Start a daemon with \`agent-fs daemon start\` or set AGENT_FS_API_
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L7013var ob=Object.create;var{getPrototypeOf:ib,defineProperty:Is,getOwnPropertyNames:sb}=Object;var tl=Object.prototype.hasOwnProperty;function ab(e){return this[e]}var db,cb,dt=(e,t,r...
L4: Install with: brew install sqlite`)}var rl=!1;var nl=g(()=>{yb()});import{mkdirSync as vb,readFileSync as bb,writeFileSync as Ss,existsSync as ol}from"fs";import{join as kn}from"pa...
L5: CREATE TABLE IF NOT EXISTS users (
...
L254: DELETE FROM meta WHERE key = 'vec_int8_index';
L255: `),!On(n))n.exec(zo);return ll(n),Cb(n,{schema:ae})}var pe=g(()=>{nl();ct();sl();Fr()});var gl;var fl=g(()=>{gl={name:"agent-fs",version:"0.18.1",packageManager:"bun@1.4.1",private...
L256: ${this.getCanonicalPath(e)}
...
L265: ${Zt.toHex(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let o of e.spli
Findings
3 Critical5 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.18.1.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.18.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.