@sentropic/h2a-runtime@0.97.9
h2a heavy runtime (sessions / k8s / tunnel, node-pty + aws-sdk). Lazily imported by @sentropic/h2a; installed separately.
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe package has no install lifecycle hook, but its explicit plugin-add command installs a selected package and writes MCP configuration for local agents. Under the agent integration policy, this guarded capability warrants a warning; the inspected source does not establish malicious intent.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user invokes the plugin-add CLI command.
Impact
The registered MCP server can be started by the configured agent; this behavior is explicit and package-feature aligned.
Mechanism
The command installs the selected package and writes MCP registration into agent configuration.
AI rationale
The package has no install lifecycle hook, but its explicit plugin-add command installs a selected package and writes MCP configuration for local agents. Under the agent integration policy, this guarded capability warrants a warning; the inspected source does not establish malicious intent.
Evidence
dist/index.jsdist/plugin.js
Decision evidence
public snapshotAI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes a runtime entrypoint and declares no install lifecycle hook.
- The CLI routes the explicit plugin-add command to pluginAdd.
- pluginAdd installs the selected package and registers its MCP server with agent CLIs.
- The plugin code writes MCP configuration to the user's Claude configuration file.
Evidence against
- The configuration change is reached through an explicit CLI command, not an install hook.
- No evidence inspected established credential theft, covert execution, or a malicious network destination.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggeddist/tmux.jsView file
12*/
L13: import { spawn, spawnSync } from "node:child_process";
L14: import { createHash, randomUUID } from "node:crypto";
High
482const bin = c.split(" ")[0];
L483: if (spawnSync("command", ["-v", bin], { shell: true, stdio: "ignore" })
L484: .status === 0) {
High
dist/central-mcp.jsView file
21const corePackage = "@sentropic/h2a";
L22: coreCentralMcp ??= import(corePackage).then((core) => {
L23: const candidate = core;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/central-mcp.jsView on unpkg · L21Findings
1 Critical8 High4 Medium3 Low
CriticalPrevious Version Dangerous Deltadist/llm-mesh.js
HighChild Processdist/tmux.js
HighShelldist/tmux.js
HighSame File Env Network Executiondist/llm-mesh.js#virtual:normalized:round1
HighCommand Output Exfiltrationdist/llm-mesh.js#virtual:normalized:round1
HighCopied Package Dependency Bridgedist/pty.js
HighExternal Ai Agent Control Surface Mutationdist/plugin.js
HighTrigger Reachable Command Output Exfiltrationdist/llm-mesh.js#virtual:normalized:round1
HighSemantic Analysis Limiteddist/auth-tools.js#virtual:normalized:round1
MediumDynamic Requiredist/central-mcp.js
MediumNetwork
Affected versions and remediation
This report applies to @sentropic/h2a-runtime@0.97.9.
See all versions of @sentropic/h2a-runtime for other recorded verdicts.
- Review the evidence and your use of @sentropic/h2a-runtime@0.97.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.