@sentropic/h2a-runtime@0.93.5
h2a heavy runtime (sessions / k8s / tunnel, node-pty + aws-sdk). Lazily imported by @sentropic/h2a; installed separately.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNo concrete malicious chain, lifecycle execution, fixed credential sink, or unconsented install-time AI-agent control-surface mutation was found. The explicit agent/MCP and credential-transfer capabilities remain security-sensitive.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs h2a plugin, remote-session, credential, or delegate commands.
Impact
A user can intentionally extend AI-agent control surfaces and transmit selected credentials to their configured remote service.
Mechanism
User-invoked MCP registration, remote credential bundling, and agent process launching.
AI rationale
No concrete malicious chain, lifecycle execution, fixed credential sink, or unconsented install-time AI-agent control-surface mutation was found. The explicit agent/MCP and credential-transfer capabilities remain security-sensitive.
Evidence
package.jsondist/plugin.jsdist/auth-tools.jsdist/delegate.jsdist/config.jsdist/attach.js~/.claude.json~/.gemini/config/mcp_config.json~/.aws/credentials~/.config/gh/hosts.yml~/.npmrc~/.docker/config.json
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Unknown with low false-positive risk.
Evidence for warning
- Explicit `plugin add` installs a user-supplied package and registers its MCP entrypoints with AI CLIs.
- Claude MCP registration can modify user-scoped Claude configuration.
- The runtime can read and bundle selected local cloud/CLI credential files for remote sessions.
- It supports explicit delegated Claude/Codex/AGY execution.
Evidence against
- package.json has no preinstall, install, postinstall, or bin lifecycle hook.
- MCP/config mutation is reached through explicit plugin commands, not import-time execution.
- Credential bundling is documented and implemented as opt-in; no fixed external exfiltration host was found.
- Network requests use a caller/configured remote base URL, not a hard-coded gateway.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/index.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, statSync, writeFileSync, } from "node:fs";
import { createInterface } from "node:readline";
baseUrl: opts.remote,
async function refreshProfileSession(baseUrl, sessionId, opts) {
const remoteProfile = (await getRemoteSession(baseUrl, sessionId)).session
const response = await refreshRemoteSession(baseUrl, sessionId, credentials, fetch, opts.name);
async function pushAllProfiles(baseUrl, sessionId, opts) {
process.stderr.write(`[h2a] sending creds for ${sent.join(", ")} to ${baseUrl}/sessions/${sessionId}: ${Object.keys(merged).join(", ")}\n`);
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkgdist/pty.jsView file
76package = @sentropic/h2a-runtime; repositoryIdentity = h2a; dependency = node-pty
L76: try {
L77: require("node-pty");
L78: }
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
Findings
4 High5 Medium3 Low
HighCredential Redirect Persistencedist/index.js
HighCopied Package Dependency Bridgedist/pty.js
HighExternal Ai Agent Control Surface Mutationdist/plugin.js
HighPrevious Version Dangerous Deltadist/delegate.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/plugin.js
MediumAi Review Evidencedist/plugin.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @sentropic/h2a-runtime@0.93.5.
See all versions of @sentropic/h2a-runtime for other recorded verdicts.
- Review the evidence and your use of @sentropic/h2a-runtime@0.93.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.