registry / @sentropic/h2a-runtime / 0.85.20
@sentropic/h2a-runtime@0.85.20
h2a heavy runtime (sessions / k8s / tunnel, node-pty + aws-sdk). Lazily imported by @sentropic/h2a; installed separately.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe package is a powerful but user-invoked CLI runtime for remote sessions and local LLM routing. Source inspection found no lifecycle execution, covert endpoint, or unconsented credential/config mutation chain.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User invokes h2a llm-mesh, account, or plugin commands.
Impact
Can intentionally proxy configured credentials to provider APIs or configure selected MCP tools.
Mechanism
User-directed credential gateway, remote-session tooling, and MCP configuration.
AI rationale
The package is a powerful but user-invoked CLI runtime for remote sessions and local LLM routing. Source inspection found no lifecycle execution, covert endpoint, or unconsented credential/config mutation chain.
Evidence
package.jsondist/index.jsdist/llm-mesh.jsdist/llm-gateway-runtime/index.jsdist/llm-gateway-runtime/proxy-anthropic.jsdist/plugin.jsdist/llm-gateway-runtime/proxy-openai.js~/.codex/auth.json~/.claude/.credentials.json~/.gemini/oauth_creds.json~/.sentropic/llm-mesh.json
Network endpoints5
auth.openai.com/oauth/tokenoauth2.googleapis.com/tokenapi.openai.comapi.anthropic.comlocalhost:3002
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- dist/llm-mesh.js can read local Codex, Claude, and Gemini credentials.
- dist/plugin.js can modify agent MCP configuration, but only through explicit plugin commands.
- dist/llm-mesh.js starts a local gateway and proxies user-configured provider requests.
Evidence against
- package.json contains no preinstall, install, or postinstall hooks.
- dist/index.js runs CLI setup only when invoked as its entrypoint.
- Credential enrollment is an explicit `llm-mesh enroll` action; stored mesh files use mode 0600.
- Gateway defaults target provider endpoints or localhost; no covert third-party exfiltration endpoint was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
3 flaggeddist/llm-mesh.jsView file
20import { fileURLToPath } from "node:url";
L21: import { spawn } from "node:child_process";
L22: import { randomBytes } from "node:crypto";
...
L26: export function sentropicDir() {
L27: return join(homedir(), ".sentropic");
L28: }
...
L51: try {
L52: return JSON.parse(readFileSync(path, "utf8"));
L53: }
...
L251: // hardcoded). Absent them, the mesh-owned transport performs the refresh.
L252: const clientId = process.env["GOOGLE_OAUTH_CLIENT_ID"];
L253: const clientSecret = process.env["GOOGLE_OAUTH_CLIENT_SECRET"];
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/llm-mesh.jsView on unpkg · L2020Trigger-reachable chain: manifest.main -> dist/index.js -> dist/llm-mesh.js
L20: import { fileURLToPath } from "node:url";
L21: import { spawn } from "node:child_process";
L22: import { randomBytes } from "node:crypto";
...
L26: export function sentropicDir() {
L27: return join(homedir(), ".sentropic");
L28: }
...
L51: try {
L52: return JSON.parse(readFileSync(path, "utf8"));
L53: }
...
L251: // hardcoded). Absent them, the mesh-owned transport performs the refresh.
L252: const clientId = process.env["GOOGLE_OAUTH_CLIENT_ID"];
L253: const clientSecret = process.env["GOOGLE_OAUTH_CLIENT_SECRET"];
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/llm-mesh.jsView on unpkg · L20Findings
3 Critical3 Medium3 Low
CriticalCredential Exfiltrationdist/llm-mesh.js
CriticalTrigger Reachable Dangerous Capabilitydist/llm-mesh.js
CriticalPrevious Version Dangerous Deltadist/llm-mesh.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @sentropic/h2a-runtime@0.85.20.
See all versions of @sentropic/h2a-runtime for other recorded verdicts.
- Review the evidence and your use of @sentropic/h2a-runtime@0.85.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.