@sentropic/h2a-runtime@0.98.7
h2a heavy runtime (sessions / k8s / tunnel, node-pty + aws-sdk). Lazily imported by @sentropic/h2a; installed separately.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package automatically forwards discovered GitHub, npm, or Docker credentials to a remote Pod and persists them in its Kubernetes Secret when a refresh probe fails. Although refresh is user-triggered and the Pod is part of the package’s intended workflow, the user is not asked to opt in to sending these additional service credentials.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs a soft refresh or refresh watch while a configured remote Pod has credentials missing for one of the default-probed tools.
Impact
Credentials for separate services can be exposed to the configured remote cluster and persisted in its session Secret without specific consent for those credentials.
Mechanism
The probe checks local credentials for gh, npm, and docker; on a failed Pod health check, it collects the local credentials, writes them into the Pod, and patches the Pod’s auth Secret without asking the user to select those tools.
Attack narrative
Running refresh or refresh watch triggers probes for GitHub, npm, and Docker by default. If a remote Pod lacks authentication for one, the package collects the corresponding local credentials, writes them into the Pod, and patches its Kubernetes auth Secret. The source describes tool credential bundling as opt-in, but this path selects these credentials automatically without asking the user.
AI rationale
The package automatically forwards discovered GitHub, npm, or Docker credentials to a remote Pod and persists them in its Kubernetes Secret when a refresh probe fails. Although refresh is user-triggered and the Pod is part of the package’s intended workflow, the user is not asked to opt in to sending these additional service credentials.
Evidence
dist/auth-tools.jsdist/soft-refresh.jsdist/index.js~/.config/gh/hosts.yml~/.npmrc~/.docker/config.json$HOME/${rel} in the session Podsession-${sessionId}-auth Kubernetes Secret
Network endpoints1
Configured Kubernetes API via kubectl and the user’s tunnel/kubeconfig; no host is hard-coded in the source.
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- A refresh pass calls the credential health probe for each session; the probe defaults to GitHub, npm, and Docker.
- When a tool probe fails, the code collects that tool’s local credentials and pushes them.
- The source identifies GitHub credentials in ~/.config/gh/hosts.yml and npm and Docker credentials in ~/.npmrc and ~/.docker/config.json; it also describes bundling credentials as opt-in.
- The code writes credentials into the remote Pod’s home directory and patches that Pod’s Kubernetes auth Secret.
Evidence against
- The transfer runs through the configured Kubernetes tunnel to this package’s remote sessions, which are intended to receive credentials.
- The probe is reached through a user-run refresh or watch workflow, and the package has no install lifecycle scripts.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/pty.jsView file
94package = @sentropic/h2a-runtime; repositoryIdentity = h2a; dependency = node-pty
L94: try {
L95: require("node-pty");
L96: }
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/pty.jsView on unpkg · L94dist/plugin.jsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
nd, args: [...args] };
root.mcpservers = servers;
return json.stringify(root, null, 2) + "\n";
}
export function mergeclaudemcpservers(json, name, command, args) {
return mergemcpserversjson(json, name, command, args, "claude.json");
}
export function mergeagymcpservers(json, name, command, args) {
return mergemcpserversjson(json, name, command, args, "mcp_config.json");
}
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/plugin.jsView on unpkgdist/auth-tools.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/auth-tools.js#virtual:normalized:round1View on unpkgdist/claude-code-cli-runner.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @sentropic/h2a-runtime@0.98.6
matchedIdentity = npm:QHNlbnRyb3BpYy9oMmEtcnVudGltZQ:0.98.6
similarity = 0.612
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/claude-code-cli-runner.jsView on unpkgdist/soft-refresh.jsView file
376export async function probePodCredHealth(sessionId, tools = ["gh", "npm", "docker"], options = {}) {
const stderr = options.stderr ?? process.stderr;
const tunnel = getTunnel();
if (!tunne
High
Ai Review Evidence
A refresh pass calls the credential health probe for each session; the probe defaults to GitHub, npm, and Docker.
dist/soft-refresh.jsView on unpkg · L376Findings
5 High3 Medium4 Low
HighCopied Package Dependency Bridgedist/pty.js
HighExternal Ai Agent Control Surface Mutationdist/plugin.js
HighSemantic Analysis Limiteddist/auth-tools.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/claude-code-cli-runner.js
HighAi Review Evidencedist/soft-refresh.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @sentropic/h2a-runtime@0.98.7.
See all versions of @sentropic/h2a-runtime for other recorded verdicts.
- Avoid installing @sentropic/h2a-runtime@0.98.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.