@sentropic/h2a-runtime@0.97.10
h2a heavy runtime (sessions / k8s / tunnel, node-pty + aws-sdk). Lazily imported by @sentropic/h2a; installed separately.
AI Security Review
scanned 26d ago · by lpm-firewall-aiSource shows agent configuration mutation only in the explicit plugin-add flow, with no package install lifecycle hook. This warrants a warning for the agent integration capability, but the inspected code does not establish malicious execution or exfiltration.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the remote plugin-add command.
Impact
The registered MCP executable can be launched by those agent clients.
Mechanism
The command registers detected MCP executables in Claude, Codex, and Gemini user configuration.
AI rationale
Source shows agent configuration mutation only in the explicit plugin-add flow, with no package install lifecycle hook. This warrants a warning for the agent integration capability, but the inspected code does not establish malicious execution or exfiltration.
Evidence
dist/plugin.js
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package has no lifecycle hook and exposes runtime entrypoints through its exports.
- The explicit plugin-add operation globally installs a requested package and registers its MCP executable in user agent configuration.
- Plugin registration writes an MCP server entry to the user's Codex configuration.
- The gateway is launched locally and its session request goes to localhost.
Evidence against
- The reviewed agent configuration change is reachable through an explicit CLI command, not an npm install hook.
- No evidence inspected establishes credential exfiltration or an active attack.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggeddist/tmux.jsView file
12*/
L13: import { spawn, spawnSync } from "node:child_process";
L14: import { createHash, randomUUID } from "node:crypto";
High
482const bin = c.split(" ")[0];
L483: if (spawnSync("command", ["-v", bin], { shell: true, stdio: "ignore" })
L484: .status === 0) {
High
dist/central-mcp.jsView file
21const corePackage = "@sentropic/h2a";
L22: coreCentralMcp ??= import(corePackage).then((core) => {
L23: const candidate = core;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/central-mcp.jsView on unpkg · L21Findings
1 Critical8 High4 Medium3 Low
CriticalPrevious Version Dangerous Deltadist/llm-mesh.js
HighChild Processdist/tmux.js
HighShelldist/tmux.js
HighSame File Env Network Executiondist/llm-mesh.js#virtual:normalized:round1
HighCommand Output Exfiltrationdist/llm-mesh.js#virtual:normalized:round1
HighCopied Package Dependency Bridgedist/pty.js
HighExternal Ai Agent Control Surface Mutationdist/plugin.js
HighTrigger Reachable Command Output Exfiltrationdist/llm-mesh.js#virtual:normalized:round1
HighSemantic Analysis Limiteddist/auth-tools.js#virtual:normalized:round1
MediumDynamic Requiredist/central-mcp.js
MediumNetwork
Affected versions and remediation
This report applies to @sentropic/h2a-runtime@0.97.10.
See all versions of @sentropic/h2a-runtime for other recorded verdicts.
- Review the evidence and your use of @sentropic/h2a-runtime@0.97.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.