registry / @desplega.ai/agent-fs / 0.18.12
@desplega.ai/agent-fs@0.18.12
Agent-first filesystem backed by S3
AI Security Review
scanned 8d ago · by lpm-firewall-aiSource inspection found no malicious behavior. The scanner’s credential and execution indicators correspond to server telemetry and user-invoked CLI setup features; the package manifest has no install hook.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Telemetry starts when the server starts, unless an opt-out environment setting is enabled.
Impact
The publisher receives package usage information; the inspected telemetry payload does not include credentials.
Mechanism
The server posts an anonymous event containing usage counts and provider and platform details to the telemetry endpoint.
AI rationale
Source inspection found no malicious behavior. The scanner’s credential and execution indicators correspond to server telemetry and user-invoked CLI setup features; the package manifest has no install hook.
Network endpoints1
proxy.desplega.sh/v1/events
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI and defines a prepublish-only build hook; it has no install lifecycle hook.
- The inspected Google SDK preinstall script is a no-op.
- The CLI sends anonymous, package-specific telemetry to a Desplega endpoint; the payload contains product usage counts and provider/platform details, not credentials.
- Telemetry can be disabled with the standard opt-out environment settings and starts with the server.
- The inspected Google SDK bundle variants import retry, authentication, and filesystem libraries.
- The inspected S3 command modules use the SDK command builder and operation schemas for named S3 actions.
- The inspected S3 pagination and waiter modules use Smithy helpers with S3 commands and client types.
- The inspected DuckDB files are compiled library modules, including a value-converter export.
Evidence against
- Server telemetry is sent automatically unless opted out, so the package does transmit usage data to its publisher’s endpoint.
Behavioral surface
ChildProcessEnvironmentVars
Source & flagged code
8 flaggeddist/cli.jsView file
755ELSE 'viewer'
L756: END`}function Da(e,t){return e.insert(Y).values({orgId:t.orgId,userId:t.userId,role:t.role}).onConflictDoUpdate({target:[Y.orgId,Y.userId],set:{role:Ab(Y.role)}}).returning({role:Y...
L757: ]))`;continue}else if(n[d]==="$"){o+=`($|(?=[\r
...
L764:
L765: `}},"x-sse-events":{"presence.snapshot":{...s,description:"Only sent when presence=1, immediately after ready."},"presence.updated":{type:"object",description:"Only sent when prese...
L766: Start a daemon with \`agent-fs daemon start\` or set AGENT_FS_API_URL to connect to a remote server.`),process.exit(1)}sp=new cD({name:"agent-fs",version:it},{capabilities:{tools:{...
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L7553var cx=Object.create;var{getPrototypeOf:lx,defineProperty:md,getOwnPropertyNames:ux}=Object;var xp=Object.prototype.hasOwnProperty;function px(e){return this[e]}var mx,fx,vt=(e,t,r...
L4: Install with: brew install sqlite`)}var Sp=!1;var Ap=h(()=>{Ix()});import{mkdirSync as xx,readFileSync as Sx,writeFileSync as fd,existsSync as Rp}from"fs";import{join as _o}from"pa...
L5: CREATE TABLE IF NOT EXISTS org_invites (
...
L294: DELETE FROM meta WHERE key = 'vec_int8_index';
L295: `),!ko(n))n.exec(Qi);return Np(n),Mx(n,{schema:oe})}var le=h(()=>{Ap();wt();_p();Dp();bn()});var Up;var $p=h(()=>{Up={name:"agent-fs",version:"0.18.12",packageManager:"bun@1.4.4",p...
L296: ${this.getCanonicalPath(e)}
...
L305: ${Ir.toHex(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let o of
Critical
Findings
3 Critical5 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.18.12.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.18.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.