@sentropic/h2a-runtime@0.97.7
h2a heavy runtime (sessions / k8s / tunnel, node-pty + aws-sdk). Lazily imported by @sentropic/h2a; installed separately.
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe scanner signals are not proof of malicious behavior. Source inspection found agent configuration mutation reachable through runtime plugin functionality, but no concrete attack or unconsented npm lifecycle mutation; warn for this agent capability.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A caller invokes the plugin registration functionality.
Impact
The configured agent may load the registered server in later sessions; no concrete malicious payload or exfiltration was established.
Mechanism
The code merges an MCP server entry into Claude or Codex user configuration.
AI rationale
The scanner signals are not proof of malicious behavior. Source inspection found agent configuration mutation reachable through runtime plugin functionality, but no concrete attack or unconsented npm lifecycle mutation; warn for this agent capability.
Evidence
dist/plugin.js
Decision evidence
public snapshotAI called this Suspicious at 76.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes a runtime entrypoint and declares no lifecycle scripts.
- The plugin module writes MCP server entries into Claude and Codex user configuration when its registration functions run.
- The CLI routes gateway environment into agent launches; inspected gateway requests target a configured local base URL.
Evidence against
- The inspected sources show explicit runtime setup and integration behavior, not an install-time attack or confirmed command-output exfiltration.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggeddist/tmux.jsView file
12*/
L13: import { spawn, spawnSync } from "node:child_process";
L14: import { createHash, randomUUID } from "node:crypto";
High
482const bin = c.split(" ")[0];
L483: if (spawnSync("command", ["-v", bin], { shell: true, stdio: "ignore" })
L484: .status === 0) {
High
dist/central-mcp.jsView file
21const corePackage = "@sentropic/h2a";
L22: coreCentralMcp ??= import(corePackage).then((core) => {
L23: const candidate = core;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/central-mcp.jsView on unpkg · L21Findings
1 Critical8 High4 Medium3 Low
CriticalPrevious Version Dangerous Deltadist/llm-mesh.js
HighChild Processdist/tmux.js
HighShelldist/tmux.js
HighSame File Env Network Executiondist/llm-mesh.js#virtual:normalized:round1
HighCommand Output Exfiltrationdist/llm-mesh.js#virtual:normalized:round1
HighCopied Package Dependency Bridgedist/pty.js
HighExternal Ai Agent Control Surface Mutationdist/plugin.js
HighTrigger Reachable Command Output Exfiltrationdist/llm-mesh.js#virtual:normalized:round1
HighSemantic Analysis Limiteddist/auth-tools.js#virtual:normalized:round1
MediumDynamic Requiredist/central-mcp.js
MediumNetwork
Affected versions and remediation
This report applies to @sentropic/h2a-runtime@0.97.7.
See all versions of @sentropic/h2a-runtime for other recorded verdicts.
- Review the evidence and your use of @sentropic/h2a-runtime@0.97.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.