@sentropic/h2a-runtime@0.94.3
h2a heavy runtime (sessions / k8s / tunnel, node-pty + aws-sdk). Lazily imported by @sentropic/h2a; installed separately.
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe package exposes an explicit command that installs plugins and registers MCP servers in agent configuration, a warning-level agent capability. The inspected evidence does not show this behavior running automatically during npm installation or establish malicious intent.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user invokes the plugin-add CLI command.
Impact
The configured agent may launch the registered plugin server in later sessions; no unconsented install-time mutation or separate malicious behavior was identified.
Mechanism
The command installs or registers a plugin and writes MCP server entries to agent configuration files.
AI rationale
The package exposes an explicit command that installs plugins and registers MCP servers in agent configuration, a warning-level agent capability. The inspected evidence does not show this behavior running automatically during npm installation or establish malicious intent.
Evidence
dist/index.jsdist/plugin.js~/.claude.json~/.codex/config.toml~/.gemini/config/mcp_config.json
Decision evidence
public snapshotAI called this Suspicious at 81.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI exposes an explicit `plugin add` command for installing plugins for agent CLIs. [dist/index.js]
- Plugin setup registers an MCP server in user-level Claude, Codex, and Gemini configuration. [dist/plugin.js]
- The manifest has no lifecycle hooks; these behaviors are invoked through CLI commands. [package.json, dist/index.js]
Evidence against
- The plugin configuration behavior is reached through an explicit CLI command, not an npm install hook. [dist/index.js]
- Other inspected integration code concerns session enrollment, migration, restore, skill sync, PTY loading, or credential detection; it does not establish an attack in this package. [dist/enroll.js, dist/migrate.js, dist/restore.js, dist/skills-sync.js, dist/pty.js, dist/auth-tools.js]
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/pty.jsView file
76package = @sentropic/h2a-runtime; repositoryIdentity = h2a; dependency = node-pty
L76: try {
L77: require("node-pty");
L78: }
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/pty.jsView on unpkg · L76dist/plugin.jsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
nd, args: [...args] };
root.mcpservers = servers;
return json.stringify(root, null, 2) + "\n";
}
export function mergeclaudemcpservers(json, name, command, args) {
return mergemcpserversjson(json, name, command, args, "claude.json");
}
export function mergeagymcpservers(json, name, command, args) {
return mergemcpserversjson(json, name, command, args, "mcp_config.json");
}
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
Findings
4 High5 Medium3 Low
HighCopied Package Dependency Bridgedist/pty.js
HighExternal Ai Agent Control Surface Mutationdist/plugin.js
HighSemantic Analysis Limiteddist/auth-tools.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencedist/config.js
MediumSuspicious Lifecycle Evidencedist/enroll.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @sentropic/h2a-runtime@0.94.3.
See all versions of @sentropic/h2a-runtime for other recorded verdicts.
- Review the evidence and your use of @sentropic/h2a-runtime@0.94.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.