@sentropic/h2a-runtime@0.85.14
h2a heavy runtime (sessions / k8s / tunnel, node-pty + aws-sdk). Lazily imported by @sentropic/h2a; installed separately.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThis is not concrete malicious behavior, but it has real explicit-user-command AI-agent control and credential-routing capability. Warn rather than block under the stated policy.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs remote enroll --install-hooks, remote plugin sync/add, or h2a llm-mesh enroll/start.
Impact
User-selected MCP code may be registered with supported agent clients or executed in configured remote pods.
Mechanism
Explicit agent configuration mutation and credential-backed LLM proxying.
AI rationale
This is not concrete malicious behavior, but it has real explicit-user-command AI-agent control and credential-routing capability. Warn rather than block under the stated policy.
Evidence
package.jsondist/index.jsdist/plugin.jsdist/enroll.jsdist/llm-mesh.jsdist/llm-gateway-runtime/proxy-openai.js~/.claude/settings.json~/.claude.json~/.codex/config.toml~/.gemini/config/mcp_config.json~/.codex/auth.json
Network endpoints4
auth.openai.com/oauth/tokenapi.openai.comapi.anthropic.comllm.sent-tech.ca
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/plugin.js registers MCP servers in Claude, Codex, and Gemini config files.
- dist/enroll.js installs Claude SessionStart/SessionEnd hooks when --install-hooks is invoked.
- dist/llm-mesh.js reads ~/.codex/auth.json for explicit account enrollment.
- dist/llm-gateway-runtime proxies LLM requests to OpenAI or Anthropic upstreams.
Evidence against
- package.json has no preinstall, install, postinstall, or bin lifecycle hook.
- Agent-config mutations are reachable through explicit CLI commands, not import/install execution.
- Hook installation is additive, idempotent, and backs up an existing settings file.
- No hidden exfiltration, remote payload loading, or destructive behavior was found in inspected paths.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
1 flaggeddist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @sentropic/h2a-runtime@0.85.13
matchedIdentity = npm:QHNlbnRyb3BpYy9oMmEtcnVudGltZQ:0.85.13
similarity = 0.952
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkgFindings
1 High2 Medium3 Low
HighPrevious Version Dangerous Deltadist/index.js
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @sentropic/h2a-runtime@0.85.14.
See all versions of @sentropic/h2a-runtime for other recorded verdicts.
- Review the evidence and your use of @sentropic/h2a-runtime@0.85.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.