registry / @desplega.ai/agent-fs / 0.18.11
@desplega.ai/agent-fs@0.18.11
Agent-first filesystem backed by S3
AI Security Review
scanned 8d ago · by lpm-firewall-aiSource inspection found vendor-aligned operational telemetry with opt-outs and no credential transfer in the inspected payload. The package manifest has no install-time hook; its prepublishOnly script builds the CLI, and the flagged child-process use supports explicit daemon management.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Telemetry starts with the API server; the CLI runs when a user invokes the agent-fs command.
Impact
Telemetry discloses operational metadata to the vendor endpoint; the inspected code does not establish credential theft or another concrete attack.
Mechanism
The server sends aggregate usage and runtime metadata to the vendor telemetry endpoint, with environment-variable opt-outs. The inspected payload construction does not include credentials.
AI rationale
Source inspection found vendor-aligned operational telemetry with opt-outs and no credential transfer in the inspected payload. The package manifest has no install-time hook; its prepublishOnly script builds the CLI, and the flagged child-process use supports explicit daemon management.
Evidence
~/.agent-fs/config.json
Network endpoints1
proxy.desplega.sh/v1/events
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes dist/cli.js as the CLI and limits its lifecycle script to prepublishOnly build work.
- The bundled telemetry respects ANONYMIZED_TELEMETRY and DO_NOT_TRACK opt-outs; it identifies events as anonymous and sends operational metadata to the vendor endpoint.
- Telemetry reports server start and periodic heartbeat events; the inspected payload contains aggregate counts and runtime metadata, not credentials.
- The inspected Google GenAI dependency declares a no-op preinstall hook.
- Google GenAI distribution entrypoints import retry support; the Node entrypoint also imports Google authentication and filesystem modules.
- The S3 command modules bind named operations to the generated command builder and matching input schemas.
- S3 pagination helpers use Smithy's paginator with matching commands and an S3 client.
- S3 existence waiters use Smithy's waiter with the corresponding HeadBucket or HeadObject command.
Evidence against
- The CLI sends default-on runtime telemetry to proxy.desplega.sh and stores a generated installation identifier in its config; the inspected source does not show credential collection in that payload.
Source & flagged code
8 flaggeddist/cli.jsView file
755ELSE 'viewer'
L756: END`}function Da(e,t){return e.insert(Y).values({orgId:t.orgId,userId:t.userId,role:t.role}).onConflictDoUpdate({target:[Y.orgId,Y.userId],set:{role:Sb(Y.role)}}).returning({role:Y...
L757: ]))`;continue}else if(n[d]==="$"){o+=`($|(?=[\r
...
L764:
L765: `}},"x-sse-events":{"presence.snapshot":{...s,description:"Only sent when presence=1, immediately after ready."},"presence.updated":{type:"object",description:"Only sent when prese...
L766: Start a daemon with \`agent-fs daemon start\` or set AGENT_FS_API_URL to connect to a remote server.`),process.exit(1)}ip=new iD({name:"agent-fs",version:it},{capabilities:{tools:{...
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L7553var ix=Object.create;var{getPrototypeOf:sx,defineProperty:md,getOwnPropertyNames:ax}=Object;var Ip=Object.prototype.hasOwnProperty;function dx(e){return this[e]}var cx,lx,vt=(e,t,r...
L4: Install with: brew install sqlite`)}var xp=!1;var Sp=h(()=>{vx()});import{mkdirSync as bx,readFileSync as wx,writeFileSync as fd,existsSync as Ap}from"fs";import{join as _o}from"pa...
L5: CREATE TABLE IF NOT EXISTS org_invites (
...
L294: DELETE FROM meta WHERE key = 'vec_int8_index';
L295: `),!ko(n))n.exec(Qi);return Cp(n),Cx(n,{schema:oe})}var le=h(()=>{Sp();wt();Rp();Np();bn()});var $p;var Lp=h(()=>{$p={name:"agent-fs",version:"0.18.11",packageManager:"bun@1.4.4",p...
L296: ${this.getCanonicalPath(e)}
...
L305: ${Ir.toHex(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let o of
Critical
Findings
3 Critical5 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.18.11.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.18.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.