@sentropic/h2a-runtime@0.98.3
h2a heavy runtime (sessions / k8s / tunnel, node-pty + aws-sdk). Lazily imported by @sentropic/h2a; installed separately.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe source supports a warning for explicit agent configuration capabilities, including user-level MCP registration and Claude session hooks. No unconsented install-time attack or concrete malicious chain was identified.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user invokes the plugin management or enrollment functionality.
Impact
These changes can affect later agent sessions, but the inspected code does not establish an unconsented install-time mutation or other concrete attack.
Mechanism
Plugin registration merges or writes MCP server entries into agent configuration; Claude enrollment adds session hooks that invoke the package’s enrollment command.
AI rationale
The source supports a warning for explicit agent configuration capabilities, including user-level MCP registration and Claude session hooks. No unconsented install-time attack or concrete malicious chain was identified.
Evidence
dist/plugin.jsdist/enroll.js
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The plugin API documents an explicit command for adding MCP plugins and registering them with agent clients.
- The plugin code writes MCP configuration to the user-level Codex configuration file.
- Claude enrollment hooks run the package’s enrollment command at session start and end.
- The manifest defines no install lifecycle hook; its only script is build.
- The inspected PTY loader requires the declared node-pty dependency when invoked.
- The daemon writes a PID file as part of starting its local gateway.
Evidence against
- The observed agent configuration changes belong to explicit plugin or enrollment operations; the inspected manifest does not run them during installation.
- The local Claude credential check is described as advisory, with no automatic action.
- The inspected source provides no evidence of credential exfiltration or an active attack.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
5 flaggeddist/central-mcp.jsView file
21const corePackage = "@sentropic/h2a";
L22: coreCentralMcp ??= import(corePackage).then((core) => {
L23: const candidate = core;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/central-mcp.jsView on unpkg · L21dist/pty.jsView file
76package = @sentropic/h2a-runtime; repositoryIdentity = h2a; dependency = node-pty
L76: try {
L77: require("node-pty");
L78: }
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/pty.jsView on unpkg · L76dist/plugin.jsView file
Findings
4 High4 Medium4 Low
HighCopied Package Dependency Bridgedist/pty.js
HighExternal Ai Agent Control Surface Mutationdist/plugin.js
HighSemantic Analysis Limiteddist/auth-tools.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/gateway-host/daemon.js
MediumDynamic Requiredist/central-mcp.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @sentropic/h2a-runtime@0.98.3.
See all versions of @sentropic/h2a-runtime for other recorded verdicts.
- Review the evidence and your use of @sentropic/h2a-runtime@0.98.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.