registry / @desplega.ai/agent-fs / 0.18.10
@desplega.ai/agent-fs@0.18.10
Agent-first filesystem backed by S3
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe scanner’s credential and process-execution matches resolve to configured service authentication, telemetry, and Docker checks for the explicit onboarding command. The inspected telemetry is package-aligned and aggregate, with an environment opt-out; no concrete attack behavior was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Starting the daemon sends a startup event and schedules periodic heartbeat events; telemetry can be disabled through environment settings.
Impact
The observed telemetry shares usage and platform metadata with the package vendor. No credential theft or unrelated data transfer was established.
Mechanism
Telemetry contains aggregate database counts, provider categories, platform information, and a persistent installation identifier. The inspected request code does not include API keys or file contents.
AI rationale
The scanner’s credential and process-execution matches resolve to configured service authentication, telemetry, and Docker checks for the explicit onboarding command. The inspected telemetry is package-aligned and aggregate, with an environment opt-out; no concrete attack behavior was found.
Evidence
package.jsondist/cli.js
Network endpoints1
proxy.desplega.sh/v1/events
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes a CLI; its only lifecycle script is a prepublish build, and the inspected Google GenAI dependency’s preinstall command is a no-op.
- Daemon telemetry sends anonymous product events to the vendor’s telemetry endpoint and can be disabled with either of two environment settings.
- Telemetry includes aggregate counts and storage and embedding provider categories; the inspected payload does not include API keys or file contents.
- The CLI sends its API key in requests to the configured agent-fs API URL, or the configured local server address.
- The inspected distribution entry modules import retry helpers and, in Node-specific entries, Google Auth and filesystem helpers.
- The S3 command modules pair commandBuilder with operation-specific schemas for access blocks, object operations, bucket metadata, encryption, uploads, and responses.
- The pagination modules use Smithy’s createPaginator with S3 client commands.
- The waiter modules use Smithy waiter helpers with S3 HeadBucket or HeadObject commands.
Evidence against
- Telemetry is enabled by default when the daemon starts and records a persistent installation identifier alongside aggregate usage and platform data.
Source & flagged code
8 flaggeddist/cli.jsView file
755ELSE 'viewer'
L756: END`}function Na(e,t){return e.insert(Y).values({orgId:t.orgId,userId:t.userId,role:t.role}).onConflictDoUpdate({target:[Y.orgId,Y.userId],set:{role:Ib(Y.role)}}).returning({role:Y...
L757: ]))`;continue}else if(n[d]==="$"){o+=`($|(?=[\r
...
L764:
L765: `}},"x-sse-events":{"presence.snapshot":{...s,description:"Only sent when presence=1, immediately after ready."},"presence.updated":{type:"object",description:"Only sent when prese...
L766: Start a daemon with \`agent-fs daemon start\` or set AGENT_FS_API_URL to connect to a remote server.`),process.exit(1)}op=new Z0({name:"agent-fs",version:it},{capabilities:{tools:{...
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L7553var nx=Object.create;var{getPrototypeOf:ox,defineProperty:pd,getOwnPropertyNames:ix}=Object;var Ep=Object.prototype.hasOwnProperty;function sx(e){return this[e]}var ax,dx,vt=(e,t,r...
L4: Install with: brew install sqlite`)}var Ip=!1;var xp=h(()=>{hx()});import{mkdirSync as yx,readFileSync as vx,writeFileSync as md,existsSync as Sp}from"fs";import{join as _o}from"pa...
L5: CREATE TABLE IF NOT EXISTS org_invites (
...
L294: DELETE FROM meta WHERE key = 'vec_int8_index';
L295: `),!ko(n))n.exec(Qi);return Op(n),kx(n,{schema:se})}var me=h(()=>{xp();wt();Ap();Cp();bn()});var Lp;var Mp=h(()=>{Lp={name:"agent-fs",version:"0.18.10",packageManager:"bun@1.4.4",p...
L296: ${this.getCanonicalPath(e)}
...
L305: ${Ir.toHex(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let o of
Critical
Findings
3 Critical5 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.18.10.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.18.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.