@sentropic/h2a-runtime@0.94.0
h2a heavy runtime (sessions / k8s / tunnel, node-pty + aws-sdk). Lazily imported by @sentropic/h2a; installed separately.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package provides explicit user-invoked AI-agent configuration mutation and remote installer execution, warranting a warning. Source inspection found no unconsented lifecycle execution, stealth persistence, or exfiltration chain.
Decision evidence
public snapshot- Explicit plugin commands register MCP servers in Claude, Codex, and Agy.
- The command directly writes user AI-agent configuration files.
- User-supplied installer commands can be persisted and executed in remote session Pods.
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The agent-config changes require explicit `plugin add` and `plugin sync` CLI actions.
- No fixed external exfiltration endpoint or hidden import-time payload was found.
Source & flagged code
4 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/pty.jsView on unpkg · L76Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
Findings
Affected versions and remediation
This report applies to @sentropic/h2a-runtime@0.94.0.
See all versions of @sentropic/h2a-runtime for other recorded verdicts.
- Review the evidence and your use of @sentropic/h2a-runtime@0.94.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.