registry / @sentropic/h2a-runtime / 0.97.2
@sentropic/h2a-runtime@0.97.2
h2a heavy runtime (sessions / k8s / tunnel, node-pty + aws-sdk). Lazily imported by @sentropic/h2a; installed separately.
AI Security Review
scanned 26d ago · by lpm-firewall-aiSource inspection supports a clean verdict: the manifest has no install lifecycle hook, and the inspected agent configuration behavior is tied to runtime plugin setup. Scanner hints identify areas for review but do not establish a malicious chain.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
An explicit runtime plugin or session command invokes the relevant setup behavior.
Impact
No malicious impact was established from the inspected source.
Mechanism
The plugin flow writes MCP registration data to agent configuration; the other reviewed integrations select config paths or handle session state and launch behavior.
AI rationale
Source inspection supports a clean verdict: the manifest has no install lifecycle hook, and the inspected agent configuration behavior is tied to runtime plugin setup. Scanner hints identify areas for review but do not establish a malicious chain.
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the runtime entrypoints and declares no install lifecycle hook; flagged setup code is reached through explicit runtime commands.
- The plugin code registers MCP servers in agent configuration when its plugin-add flow is invoked; this is an agent capability, but the inspected source does not establish an unconsented install-time mutation.
- Other flagged files handle MCP config path selection, explicit session hooks, local token-expiry advisories, session migration and discovery, PTY loading, auth-file selection, and terminal layout dispatch.
Evidence against
- No concrete malicious behavior was established in the inspected source; the agent configuration writes are part of the plugin-add flow rather than an npm lifecycle hook.
- The package manifest contains no preinstall, install, or postinstall script.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
6 flaggeddist/central-mcp.jsView file
21const corePackage = "@sentropic/h2a";
L22: coreCentralMcp ??= import(corePackage).then((core) => {
L23: const candidate = core;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/central-mcp.jsView on unpkg · L21dist/pty.jsView file
76package = @sentropic/h2a-runtime; repositoryIdentity = h2a; dependency = node-pty
L76: try {
L77: require("node-pty");
L78: }
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/pty.jsView on unpkg · L76dist/plugin.jsView file
Findings
4 High4 Medium4 Low
HighCopied Package Dependency Bridgedist/pty.js
HighExternal Ai Agent Control Surface Mutationdist/plugin.js
HighSemantic Analysis Limiteddist/auth-tools.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/launch-layout.js
MediumDynamic Requiredist/central-mcp.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @sentropic/h2a-runtime@0.97.2.
See all versions of @sentropic/h2a-runtime for other recorded verdicts.
- Review the evidence and your use of @sentropic/h2a-runtime@0.97.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.