@sentropic/h2a-runtime@0.85.19
h2a heavy runtime (sessions / k8s / tunnel, node-pty + aws-sdk). Lazily imported by @sentropic/h2a; installed separately.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiNo malicious automatic execution chain was found, but explicit commands modify AI-agent configuration and can register executable MCP servers. Policy classifies this first-party, user-invoked capability as warn rather than block.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs h2a plugin/enroll/llm-mesh commands.
Impact
Can add MCP execution entries and handle provider tokens under the invoking user's account.
Mechanism
User-invoked agent configuration and credential-backed gateway management.
AI rationale
No malicious automatic execution chain was found, but explicit commands modify AI-agent configuration and can register executable MCP servers. Policy classifies this first-party, user-invoked capability as warn rather than block.
Evidence
package.jsondist/index.jsdist/plugin.jsdist/enroll.jsdist/llm-mesh.js~/.claude.json~/.claude/settings.json~/.codex/config.toml~/.codex/auth.json~/.sentropic/llm-mesh.json
Network endpoints4
oauth2.googleapis.com/tokenauth.openai.com/oauth/tokenapi.openai.comapi.anthropic.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/plugin.js registers MCP servers in Claude, Codex, and Gemini config files.
- dist/index.js exposes explicit plugin add/sync commands, including user-supplied shell or HTTPS installer options.
- dist/llm-mesh.js reads local Codex, Claude, and Gemini credentials and persists gateway account data.
- dist/llm-mesh.js refreshes enrolled OAuth credentials against provider token endpoints.
Evidence against
- package.json has no lifecycle scripts.
- dist/index.js runs main only when invoked as its entrypoint; imports do not start the CLI.
- Agent-config writes require explicit plugin or enroll command actions.
- No covert exfiltration, remote payload fetch-and-execute, or install-time mutation was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
1 flaggeddist/llm-mesh.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @sentropic/h2a-runtime@0.85.16
matchedIdentity = npm:QHNlbnRyb3BpYy9oMmEtcnVudGltZQ:0.85.16
similarity = 0.746
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/llm-mesh.jsView on unpkgFindings
1 High2 Medium3 Low
HighPrevious Version Dangerous Deltadist/llm-mesh.js
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @sentropic/h2a-runtime@0.85.19.
See all versions of @sentropic/h2a-runtime for other recorded verdicts.
- Review the evidence and your use of @sentropic/h2a-runtime@0.85.19 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.