registry / AI-agent capability abuse / @sentropic/h2a-runtime / 0.94.1

@sentropic/h2a-runtime@0.94.1

h2a heavy runtime (sessions / k8s / tunnel, node-pty + aws-sdk). Lazily imported by @sentropic/h2a; installed separately.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The package contains explicit-user-command AI-agent configuration mutation and arbitrary installer support, warranting a warning. Static inspection found no concrete malicious chain, stealth trigger, or credential exfiltration.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `h2a plugin add` and optionally `h2a plugin sync`.

Impact

Configured plugin code may run through registered agent MCP servers.

Mechanism

User-directed plugin installation and MCP configuration registration.

AI rationale

Evidence

package.jsondist/index.jsdist/plugin.jsdist/llm-mesh.js~/.claude.json~/.codex/config.toml~/.gemini/config/mcp_config.json

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Explicit `plugin add` can install arbitrary packages or user-supplied curl/shell installers.
It registers selected plugin executables as MCP servers for Claude, Codex, and agy.
Plugin sync writes MCP configuration into remote session Pods.

Evidence against

package.json has no lifecycle scripts.
CLI parsing is guarded by an entrypoint check; import alone does not run commands.
No fixed external exfiltration endpoint or secret-harvesting chain was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 84 file(s), 1.32 MB of source, external domains: 127.0.0.1

Source & flagged code

4 flagged

dist/pty.jsView file

76package = @sentropic/h2a-runtime; repositoryIdentity = h2a; dependency = node-pty L76: try { L77: require("node-pty"); L78: }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/pty.jsView on unpkg · L76

dist/plugin.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: nd, args: [...args] }; root.mcpservers = servers; return json.stringify(root, null, 2) + "\n"; } export function mergeclaudemcpservers(json, name, command, args) { return mergemcpserversjson(json, name, command, args, "claude.json"); } export function mergeagymcpservers(json, name, command, args) { return mergemcpserversjson(json, name, command, args, "mcp_config.json"); }

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

Findings

3 High4 Medium3 Low

HighCopied Package Dependency Bridgedist/pty.js

HighExternal Ai Agent Control Surface Mutationdist/plugin.js

HighPrevious Version Dangerous Deltadist/llm-mesh.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @sentropic/h2a-runtime@0.94.1.

See all versions of @sentropic/h2a-runtime for other recorded verdicts.

Review the evidence and your use of @sentropic/h2a-runtime@0.94.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-21 10:25:40.558Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / AI-agent capability abuse / @sentropic/h2a-runtime / 0.94.1

@sentropic/h2a-runtime@0.94.1

h2a heavy runtime (sessions / k8s / tunnel, node-pty + aws-sdk). Lazily imported by @sentropic/h2a; installed separately.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `h2a plugin add` and optionally `h2a plugin sync`.

Impact

Configured plugin code may run through registered agent MCP servers.

Mechanism

User-directed plugin installation and MCP configuration registration.

AI rationale

Evidence

package.jsondist/index.jsdist/plugin.jsdist/llm-mesh.js~/.claude.json~/.codex/config.toml~/.gemini/config/mcp_config.json

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Explicit `plugin add` can install arbitrary packages or user-supplied curl/shell installers.
It registers selected plugin executables as MCP servers for Claude, Codex, and agy.
Plugin sync writes MCP configuration into remote session Pods.

Evidence against

package.json has no lifecycle scripts.
CLI parsing is guarded by an entrypoint check; import alone does not run commands.
No fixed external exfiltration endpoint or secret-harvesting chain was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 84 file(s), 1.32 MB of source, external domains: 127.0.0.1

Source & flagged code

4 flagged

dist/pty.jsView file

76package = @sentropic/h2a-runtime; repositoryIdentity = h2a; dependency = node-pty L76: try { L77: require("node-pty"); L78: }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/pty.jsView on unpkg · L76

dist/plugin.jsView file

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

Findings

3 High4 Medium3 Low

HighCopied Package Dependency Bridgedist/pty.js

HighExternal Ai Agent Control Surface Mutationdist/plugin.js

HighPrevious Version Dangerous Deltadist/llm-mesh.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @sentropic/h2a-runtime@0.94.1.

See all versions of @sentropic/h2a-runtime for other recorded verdicts.

Review the evidence and your use of @sentropic/h2a-runtime@0.94.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-21 10:25:40.558Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.