@sentropic/h2a-runtime@0.96.1
h2a heavy runtime (sessions / k8s / tunnel, node-pty + aws-sdk). Lazily imported by @sentropic/h2a; installed separately.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis package deliberately exposes an explicit agent-extension installation workflow, including writes to Codex configuration and execution of user-specified installers. It has no lifecycle hooks and no confirmed autonomous or concealed malicious chain.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs `h2a plugin add` and, for remote installation, `h2a plugin sync`.
Impact
A user-selected plugin can gain MCP execution through configured agent clients.
Mechanism
Explicit agent MCP registration and remote plugin installation.
AI rationale
This package deliberately exposes an explicit agent-extension installation workflow, including writes to Codex configuration and execution of user-specified installers. It has no lifecycle hooks and no confirmed autonomous or concealed malicious chain.
Evidence
package.jsondist/index.jsdist/plugin.jsdist/auth-bundle.jsdist/central-mcp.jsdist/tunnel.js~/.codex/config.toml~/.claude.json~/.gemini/config/mcp_config.json
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Explicit `h2a plugin add` installs packages and registers MCP servers for agent CLIs.
- The command writes a node MCP entry into `~/.codex/config.toml`.
- User-supplied `--curl` or `--install` commands are persisted for explicit `plugin sync` execution in remote pods.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hooks.
- Agent-config mutation is reached through documented CLI subcommands, not on import or installation.
- No covert exfiltration, stealth persistence, or unconsented lifecycle-triggered control-surface mutation was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/central-mcp.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @sentropic/h2a-runtime@0.94.2
matchedIdentity = npm:QHNlbnRyb3BpYy9oMmEtcnVudGltZQ:0.94.2
similarity = 0.869
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/central-mcp.jsView on unpkg21const corePackage = "@sentropic/h2a";
L22: coreCentralMcp ??= import(corePackage).then((core) => {
L23: const candidate = core;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/central-mcp.jsView on unpkg · L21dist/pty.jsView file
76package = @sentropic/h2a-runtime; repositoryIdentity = h2a; dependency = node-pty
L76: try {
L77: require("node-pty");
L78: }
Findings
3 High6 Medium3 Low
HighCopied Package Dependency Bridgedist/pty.js
HighExternal Ai Agent Control Surface Mutationdist/plugin.js
HighPrevious Version Dangerous Deltadist/central-mcp.js
MediumDynamic Requiredist/central-mcp.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/plugin.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @sentropic/h2a-runtime@0.96.1.
See all versions of @sentropic/h2a-runtime for other recorded verdicts.
- Review the evidence and your use of @sentropic/h2a-runtime@0.96.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.