@sentropic/h2a-runtime@0.96.2
h2a heavy runtime (sessions / k8s / tunnel, node-pty + aws-sdk). Lazily imported by @sentropic/h2a; installed separately.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not malicious install-time behavior, but it has real user-invoked AI-agent control-surface and credential-forwarding capability. Per policy, that warrants a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs h2a plugin add, h2a plugin sync, or h2a enroll --install-hooks.
Impact
Configured agent clients or remote session Pods may launch the user-selected MCP or h2a command.
Mechanism
User-invoked installation and AI-agent configuration mutation.
AI rationale
This is not malicious install-time behavior, but it has real user-invoked AI-agent control-surface and credential-forwarding capability. Per policy, that warrants a warning rather than a publish block.
Evidence
dist/plugin.jsdist/enroll.js~/.claude.json~/.codex/config.toml~/.gemini/config/mcp_config.json~/.claude/settings.json$HOME/.claude.json$HOME/.codex/config.toml$HOME/.gemini/config/mcp_config.json
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package exposes explicit plugin commands that install selected packages and register their MCP servers for several AI-agent CLIs.
- Its plugin flow writes MCP launch commands into Claude, Codex, and Antigravity configuration files, including remote session Pods.
- An explicit hook-install option modifies Claude Code settings to run h2a commands at session start and end.
- It can collect selected local credential files for remote sessions, but the source states this is opt-in.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle script.
- The configuration and plugin mutations are reachable through named CLI commands rather than package installation or module import.
- The only directly evidenced gateway endpoints are loopback addresses; no external exfiltration endpoint was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
6 flaggeddist/central-mcp.jsView file
21const corePackage = "@sentropic/h2a";
L22: coreCentralMcp ??= import(corePackage).then((core) => {
L23: const candidate = core;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/central-mcp.jsView on unpkg · L21dist/pty.jsView file
76package = @sentropic/h2a-runtime; repositoryIdentity = h2a; dependency = node-pty
L76: try {
L77: require("node-pty");
L78: }
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/pty.jsView on unpkg · L76dist/plugin.jsView file
Findings
4 High5 Medium3 Low
HighCopied Package Dependency Bridgedist/pty.js
HighExternal Ai Agent Control Surface Mutationdist/plugin.js
HighSemantic Analysis Limiteddist/auth-tools.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/plugin.js
MediumDynamic Requiredist/central-mcp.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @sentropic/h2a-runtime@0.96.2.
See all versions of @sentropic/h2a-runtime for other recorded verdicts.
- Review the evidence and your use of @sentropic/h2a-runtime@0.96.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.