registry / @sentropic/h2a-runtime / 0.98.4
@sentropic/h2a-runtime@0.98.4
h2a heavy runtime (sessions / k8s / tunnel, node-pty + aws-sdk). Lazily imported by @sentropic/h2a; installed separately.
AI Security Review
scanned 24d ago · by lpm-firewall-aiSource inspection found explicit user-invoked agent plugin setup and hook installation, with no npm lifecycle hook or verified unconsented control-surface mutation. The guarded agent integration merits a warning, but the inspected behavior does not establish malicious activity.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the plugin add command, or later runs the documented remote plugin sync operation.
Impact
The selected plugin gains an agent launch path; the source inspected does not establish covert setup, credential theft, or other malicious behavior.
Mechanism
The CLI installs the requested plugin and adds an MCP server entry to Claude, Gemini, or Codex configuration so the agent can launch it.
AI rationale
Source inspection found explicit user-invoked agent plugin setup and hook installation, with no npm lifecycle hook or verified unconsented control-surface mutation. The guarded agent integration merits a warning, but the inspected behavior does not establish malicious activity.
Evidence
dist/plugin.jsdist/index.js
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package manifest has no install, preinstall, or postinstall hook; its only script is build.
- The enroll module exposes hook installation through an explicit install-hooks option and merges hooks into Claude settings while preserving unrelated hooks.
- The plugin command registers MCP servers in agent configuration files and is invoked through an explicit plugin add command.
- Plugin package installation uses npm install -g for the package selected by the caller.
- The inspected credential bundling module describes selection by the user and never automatic bundling.
Evidence against
- The CLI can register MCP servers in user-level Claude, Gemini, and Codex configuration, enabling later agent processes to launch those servers.
- The package offers explicit curl or shell installer options for propagation into remote session pods.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
5 flaggeddist/central-mcp.jsView file
21const corePackage = "@sentropic/h2a";
L22: coreCentralMcp ??= import(corePackage).then((core) => {
L23: const candidate = core;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/central-mcp.jsView on unpkg · L21dist/pty.jsView file
76package = @sentropic/h2a-runtime; repositoryIdentity = h2a; dependency = node-pty
L76: try {
L77: require("node-pty");
L78: }
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/pty.jsView on unpkg · L76dist/plugin.jsView file
Findings
4 High4 Medium4 Low
HighCopied Package Dependency Bridgedist/pty.js
HighExternal Ai Agent Control Surface Mutationdist/plugin.js
HighSemantic Analysis Limiteddist/auth-tools.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/index.js
MediumDynamic Requiredist/central-mcp.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @sentropic/h2a-runtime@0.98.4.
See all versions of @sentropic/h2a-runtime for other recorded verdicts.
- Review the evidence and your use of @sentropic/h2a-runtime@0.98.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.