registry / @desplega.ai/agent-fs / 0.18.5
@desplega.ai/agent-fs@0.18.5
Agent-first filesystem backed by S3
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe manifest’s lifecycle hook builds the CLI before publishing and does not run an install-time payload. The inspected runtime telemetry is package-related, sends aggregate metadata to the vendor endpoint, and honors standard opt-out settings; no concrete attack behavior was established.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Starting the agent-fs API server.
Impact
The vendor receives package usage and platform telemetry; the inspected data does not establish credential or file-content disclosure.
Mechanism
The server sends anonymous start and heartbeat events with an installation identifier and aggregate usage and platform details. Standard telemetry opt-out settings disable sending.
AI rationale
The manifest’s lifecycle hook builds the CLI before publishing and does not run an install-time payload. The inspected runtime telemetry is package-related, sends aggregate metadata to the vendor endpoint, and honors standard opt-out settings; no concrete attack behavior was established.
Evidence
package.jsondist/cli.js
Network endpoints1
proxy.desplega.sh/v1/events
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines only a prepublish build hook, with the CLI as its executable entrypoint.
- Telemetry is disabled when either standard opt-out setting is set.
- When the API server starts, the package sends anonymous start and heartbeat events; the payload uses a generated installation identifier.
- The event summary contains aggregate counts and storage, embedding, operating system, and architecture categories.
- The telemetry collector is the package vendor’s proxy endpoint.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/cli.jsView file
707};
L708: `,Vy;var Yc=h(()=>{Vy=new WeakMap});import{and as Gy,eq as Zs,inArray as kk}from"drizzle-orm";async function ea(e,t,r,n){let o=e.$client,i=[],s=new Set;while(i.length<n){let a=Math...
L709: (${C.path} >= ${d} AND ${C.path} < ${l})
...
L715: `:`[${n[d]}\r
L716: ]`;continue}if(o+=n[d],n[d]==="\\")i=!0;else if(s&&n[d]==="]")s=!1;else if(!s&&n[d]==="[")s=!0}try{new RegExp(o)}catch{return console.warn(`Could not convert regex pattern at ${t.c...
L717: data: {"driveId":"drive-id","at":"2026-09-30T12:00:00.000Z"}
...
L720:
L721: `}},"x-sse-events":{"presence.snapshot":{...s,description:"Only sent when presence=1, immediately after ready."},"presence.updated":{type:"object",description:"Only sent when prese...
L722: Start a daemon with \`agent-fs daemon start\` or set AGENT_FS_API_
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L7073var iI=Object.create;var{getPrototypeOf:sI,defineProperty:Ua,getOwnPropertyNames:aI}=Object;var Uu=Object.prototype.hasOwnProperty;function dI(e){return this[e]}var cI,lI,mt=(e,t,r...
L4: Install with: brew install sqlite`)}var Fu=!1;var ju=h(()=>{vI()});import{mkdirSync as bI,readFileSync as wI,writeFileSync as Fa,existsSync as Hu}from"fs";import{join as uo}from"pa...
L5: CREATE TABLE IF NOT EXISTS users (
...
L254: DELETE FROM meta WHERE key = 'vec_int8_index';
L255: `),!mo(n))n.exec(Di);return Ku(n),CI(n,{schema:ie})}var me=h(()=>{ju();gt();qu();pn()});var Qu;var Ju=h(()=>{Qu={name:"agent-fs",version:"0.18.5",packageManager:"bun@1.4.1",private...
L256: ${this.getCanonicalPath(e)}
...
L265: ${mr.toHex(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let o of e.spli
Findings
3 Critical5 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.18.5.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.18.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.